Oracle Service Bus: Vulnerability enabling takeover via HTTP
Summary
Oracle Service Bus versions 12.2.1.4.0 and 14.1.2.0.0, a component of Oracle Fusion Middleware, are affected by a vulnerability in the Core component. A low-privileged attacker with network access via HTTP can exploit it with low complexity and take over Oracle Service Bus, with high impact on confidentiality, integrity and availability. The CVSS vector assumes a low-privileged account, while the CWE is CWE-306 (Missing Authentication), so the Oracle risk matrix should be checked to see whether authentication is actually required.
Affected
- Oracle Service Bus 12.2.1.4.0
- Oracle Service Bus 14.1.2.0.0
Fixed in
- Unknown. Take the fixed versions from the Oracle Critical Patch Update of October 2026 (Patch Availability table) and do not infer them.
Workaround
- Unknown. No vendor-documented interim workaround found.
- Restrict HTTP access to Service Bus consoles and services to trusted internal networks or VPN.
- Review and reduce accounts that can log in.
- Monitor Service Bus and WebLogic logs for unusual administrative or configuration activity.
Exploitation
- Not listed in the CISA KEV catalogue.
- CISA SSVC assessment: exploitation none, automatable no, technical impact total.
- EPSS: 0.00389.
- No public proof of concept found in limited searches.
Our recommendation
- Check whether any Oracle Service Bus 12.2.1.4.0 or 14.1.2.0.0 instances exist, including test and legacy environments.
- Apply the October 2026 CPU patches using the fixed versions from the current Oracle advisory (check the current revision first).
- Until patched, make sure HTTP endpoints are not reachable from the internet and only trusted accounts can log in.
- Re-check NVD, the CISA KEV catalogue and the Oracle advisory for changes in exploitation status.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update, October 2026 www.oracle.com
- Oracle October 2026 CPU release blog blogs.oracle.com
- CVE-2026-87419 on OpenCVE app.opencve.io
- CVE-2026-87419 on Vulners (NVD) vulners.com
- CVE-2026-87419 on Strix www.strix.ai
- Oracle October 2026 CPU on Vulners vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 11:37.
Original description (NVD)
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus. Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.