Oracle Fusion Middleware Vulnerabilities Include Four CVSS 10 Bugs

TL;DR

Oracle patched 203 Oracle Fusion Middleware vulnerabilities in its October 2026 Critical Patch Update. Four of them score a perfect CVSS 10.0, and 131 need no authentication to exploit. SOA Suite, WebLogic Server, and Access Manager carry the most dangerous bugs.

CVE	CVSS (CVSSv3)	Type	Status
CVE-2026-87337	10	Awaiting analysis	Not exploited
CVE-2026-91216	10	Awaiting analysis	Not exploited
CVE-2026-91221	10	Awaiting analysis	Not exploited
CVE-2026-91231	10	Awaiting analysis	Not exploited
CVE-2026-83399	9.8	CWE-287	Not exploited

Product family	Oracle Fusion Middleware
Patches	203 (40 Critical, 91 High, 66 Medium, 6 Low)
Remote, no authentication	131 patches
CVSS 10.0	CVE-2026-87337, CVE-2026-91216, CVE-2026-91221, CVE-2026-91231
Most affected	SOA Suite, WebLogic Server, Access Manager
Exploitation status	No in-the-wild exploitation or public PoC confirmed
Source	Oracle October 2026 risk matrix

Why It Matters

Fusion Middleware is the glue layer of many Oracle deployments. It runs business workflows, single sign-on, and web applications. As a result, a single flaw here can expose data across the whole stack.

Fusion Middleware also has the highest severity count in this Oracle Critical Patch Update. It accounts for 40 of the 112 critical patches. That is more than any other product family.

History adds weight to these numbers. WebLogic flaws such as CVE-2020-14882 came under attack within days of their patches. Likewise, Access Manager flaw CVE-2021-35587 later landed in CISA’s KEV catalog.

The Four CVSS 10.0 Flaws

CVE-2026-87337 – Oracle Access Manager

This bug sits in the Authentication Engine of Oracle Access Manager. An unauthenticated attacker can exploit it over HTTP. According to Oracle, a successful attack grants full read and write access to all Access Manager data. The flaw also involves a scope change, so the impact can reach connected applications.

CVE-2026-91216 and CVE-2026-91221 – Oracle SOA Suite Fabric Layer

Both flaws affect the Fabric Layer of SOA Suite. An attacker can reach them over the T3 and IIOP protocols without credentials. Oracle states that either bug can lead to a full “takeover of Oracle SOA Suite.”

CVE-2026-91231 – Oracle SOA Suite Adapters

This flaw lives in the SOA Suite Adapters component. Unlike the Fabric Layer bugs, it is reachable over plain HTTP. The result is the same, however: complete takeover with a scope change.

WebLogic Server Flaws

WebLogic Server received 11 patches this quarter, and every one is remotely exploitable without authentication. Two of them reach CVSS 9.8:

• CVE-2026-83399 affects the Core component over T3 and IIOP. It can lead to full takeover.
• CVE-2026-91323 also affects Core, but over HTTP. It can likewise lead to full takeover.

In addition, CVE-2026-87302 (CVSS 9.1) allows unauthorized access to and changes of critical data. Oracle also fixed a Spring Framework issue, CVE-2026-41855, which scores 8.1 in WebLogic.

Affected Products and Versions

Product	Patches	Remote, no auth	Critical
Oracle SOA Suite	30	16	15
Oracle Business Process Management Suite	7	4	4
Oracle WebLogic Server	11	11	3
Oracle Access Manager	9	9	2
Oracle Outside In Technology	31	20	2
Oracle Data Integrator	5	3	2
Oracle Managed File Transfer	2	2	2
Helidon	22	21	1

The main affected versions are:

• Oracle SOA Suite: 12.2.1.4.0 and 14.1.2.0.0
• Oracle WebLogic Server: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0
• Oracle Access Manager: 12.2.1.4.0 and 14.1.2.1.0

How the Attack Works

Most of these Oracle Fusion Middleware vulnerabilities share a simple profile. They are easy to exploit and need only network access. No user has to click anything.

T3 and IIOP deserve special attention. These are WebLogic’s native remote protocols, and attackers have abused them for years. When exposed to the internet, they offer a direct path to the server.

Oracle has not released technical details for these flaws. No public exploit code has been confirmed either. Still, the scores and attack vectors point to high risk.

Patch and Mitigation Steps

Apply the October 2026 patches to all Fusion Middleware components. Start with Access Manager, SOA Suite, and WebLogic Server.

If you cannot patch at once, take these steps:

1. Block T3 and IIOP from untrusted networks, for example with WebLogic connection filters.
2. Remove admin consoles and SOA endpoints from public access.
3. Place Access Manager behind strict network controls and watch its logs for unusual authentication requests.

The full list is in the Oracle October 2026 advisory. For the wider picture, read our Oracle Critical Patch Update roundup.

The Bottom Line

Four CVSS 10.0 flaws make Fusion Middleware the top priority this quarter. Patch internet-facing SOA Suite, WebLogic, and Access Manager servers first. Then work through the remaining 199 fixes.