IT SBIT Services
Schneeberger
DEEN
CVE tracker

Oracle HTTP Server: Unauthorized data access and modification in OSSL Module

CVE-2026-87347Critical 9.6

← All vulnerabilities

Summary

Oracle HTTP Server versions 12.2.1.4.0 and 14.1.2.0.0 (as part of Oracle Fusion Middleware) contain a critical vulnerability in the OSSL Module. An attacker with a low-privileged account and network access via HTTP can gain unauthorized read, creation, modification or deletion access to data the server handles, with a changed scope that can affect other products. Exploitation requires no user interaction. The fix is part of Oracle's October 2026 Critical Patch Update.

Affected

  • Oracle HTTP Server 12.2.1.4.0
  • Oracle HTTP Server 14.1.2.0.0 (one source lists 14.1.2.1.0; to be confirmed in Oracle's advisory)
  • Deployments that include Oracle HTTP Server, such as Oracle E-Business Suite or PeopleSoft, may also be affected

Fixed in

Fixed in Oracle's October 2026 Critical Patch Update (published 20 October 2026).

  • Patch IDs and exact fixed versions: Unknown. Apply the October 2026 Fusion Middleware patch for the installed release.

Workaround

Unknown. No workaround was found in the sources reviewed. Patching is the recommended fix.

Exploitation

  • No public reports of exploitation found.
  • Not listed in the CISA KEV catalogue as of 21 October 2026.
  • CISA SSVC assessment: exploitation none, not automatable, total technical impact.
  • No public proof-of-concept found.
  • A related Oracle HTTP Server flaw (CVE-2026-21962) was added to KEV after a public PoC appeared, so the status may change quickly.

Our recommendation

  • Check whether any Oracle HTTP Server or Fusion Middleware 12.2.1.4.0 or 14.1.2.x instance exists, including as part of EBS or PeopleSoft.
  • Obtain the exact patch IDs from Oracle's October 2026 advisory and apply the patches, including related Database and Fusion Middleware updates.
  • Prioritise internet-facing servers and review which accounts can reach them; restrict access where possible.
  • Monitor for KEV addition or public PoC and re-check the NVD record once analysis is complete.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 22:22.

Original description (NVD)

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HTTP Server. While the vulnerability is in Oracle HTTP Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server accessible data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed