Oracle Service Bus: Improper access control allows takeover over HTTP
Summary
Oracle Service Bus versions 12.2.1.4.0 and 14.1.2.0.0, part of Oracle Fusion Middleware, contain a flaw in the Core component classified as improper access control (CWE-284). An attacker with a low-privilege account and network access via HTTP can compromise the product, with impacts on confidentiality, integrity and availability rated high (CVSS 3.1 8.8). The attack requires no user interaction. Oracle's advisory describes the outcome as takeover of Oracle Service Bus.
Affected
- Oracle Service Bus 12.2.1.4.0
- Oracle Service Bus 14.1.2.0.0
Fixed in
Unknown. Check the Oracle Service Bus row of the Oracle Critical Patch Update Advisory for October 2026 for the patch for each branch.
Workaround
Unknown. No vendor workaround was found.
Exploitation
- CISA SSVC: exploitation none, automatable no.
- Not listed in CISA KEV; EPSS below 1%.
- No public proof-of-concept found.
- No evidence of exploitation in the wild found.
Our recommendation
- Confirm the fixed Service Bus patch for each branch in the Oracle October 2026 advisory and apply it, together with the other Service Bus CVEs of the same CPU.
- Check whether Oracle Service Bus is deployed at all, and whether its console or services are reachable from the internet.
- Until patched, restrict HTTP access to required internal sources and review accounts with low-privilege access.
- Monitor logs for unusual HTTP access to Service Bus.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory, October 2026 www.oracle.com
- NVD record via Vulners: CVE-2026-87364 vulners.com
- OpenCVE: CVE-2026-87364 app.opencve.io
- CIRCL via Vulners: CVE-2026-87364 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:40.
Original description (NVD)
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus. Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.