CVE-2026-60530 in HTTP Server
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_http2.so). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HTTP Server executes to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability resides within the Oracle HTTP Server component known as mod_http2.so, which is part of Oracle Fusion Middleware and specifically affects version 14.1.2.0.0. This represents a critical security flaw that operates at the infrastructure level where the web server executes, making it particularly dangerous for enterprise environments that rely on Oracle's middleware stack. The vulnerability's classification as easily exploitable indicates that attackers with minimal privileges can leverage this weakness to gain significant control over the target system.
The technical nature of this flaw lies within the HTTP/2 module implementation that processes incoming requests and manages connections between clients and the web server. When an attacker successfully exploits this vulnerability, they can achieve complete compromise of the Oracle HTTP Server instance, which constitutes a severe privilege escalation scenario given that only low-privileged access to the infrastructure is required for exploitation. The CVSS 3.1 score of 7.8 reflects the high impact across all three core security principles: confidentiality, integrity, and availability.
From an operational perspective, this vulnerability creates significant risk for organizations using Oracle HTTP Server in production environments. The fact that it requires only local access to the server infrastructure makes it particularly concerning since attackers who gain foothold through other means can leverage this weakness to escalate their privileges and potentially move laterally throughout the network. The impact extends beyond simple data theft or service disruption, as complete system takeover allows for persistent access and control over all web applications hosted by the compromised server.
Security professionals should consider this vulnerability in relation to the CWE (Common Weakness Enumeration) framework where such flaws typically map to weakness categories involving improper input validation or memory corruption issues within web server modules. The ATT&CK (Attack Technique for Knowledge) framework would categorize this as a privilege escalation technique that leverages server-side vulnerabilities, potentially enabling later stages of the attack lifecycle including lateral movement and data exfiltration.
Organizations should immediately implement mitigations including patching the Oracle HTTP Server to a version that addresses this specific vulnerability, as well as restricting local access to the server infrastructure. Network segmentation and monitoring for unusual HTTP/2 traffic patterns can serve as additional defensive measures while permanent fixes are deployed. The vulnerability's ease of exploitation makes proactive remediation essential rather than reactive response, particularly given the high CVSS score indicating substantial risk to enterprise security posture.