CVE-2026-87347 in HTTP Server
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HTTP Server. While the vulnerability is in Oracle HTTP Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server accessible data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the OSSL Module of Oracle HTTP Server, a critical component of the Oracle Fusion Middleware suite affecting versions 12.2.1.4.0 and 14.1.2.0.0. This security flaw is classified as easily exploitable by an attacker with low privileges who possesses network access via the HTTP protocol. The severity of this vulnerability is underscored by a CVSS 3.1 Base Score of 9.6, indicating a critical level of risk primarily driven by high impacts on both confidentiality and integrity. The specific vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) reveals that while availability is not directly impacted, the scope change from S:C indicates that an attack confined to Oracle HTTP Server can significantly impact additional products within the broader environment, thereby expanding the blast radius of a successful exploitation.
From a technical perspective, this vulnerability allows for unauthorized creation, deletion, or modification of critical data as well as all accessible data managed by Oracle HTTP Server. Furthermore, it grants attackers unauthorized access to sensitive information that would otherwise be protected. This aligns with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization, where the system fails to properly enforce restrictions on what authenticated users are allowed to do. The ability to modify or delete data points toward potential integrity violations described in CWE-354 Improper Validation of Integrity Check Value if the modification bypasses validation mechanisms, or simply unauthorized write access due to insufficient access controls.
The operational impact is severe given the central role Oracle HTTP Server plays as a web server and reverse proxy for various enterprise applications. An attacker leveraging this flaw can exfiltrate sensitive corporate data, alter configuration files or application content, or delete critical resources leading to service disruption through data loss rather than direct denial of service. The scope change aspect means that compromising the web server layer may provide a foothold into backend databases, application servers, or other integrated middleware components, facilitating lateral movement within the network infrastructure. This scenario is consistent with ATT&CK technique T1078 Valid Accounts if low-privileged credentials are used to gain initial access, followed by T1530 Data from Local System Extraction for data theft and T1489 Service Stop or T1485 Data Destruction depending on the specific actions taken during exploitation.
Mitigation strategies must prioritize immediate patching of Oracle HTTP Server to the latest available version that addresses this vulnerability in both supported release lines 12c and 14g. Organizations should also implement strict network segmentation to limit direct HTTP access from untrusted networks to these middleware components, ensuring they are only reachable through secure channels or via a Web Application Firewall with robust rule sets designed to detect anomalous request patterns associated with privilege escalation attempts. Additionally, enforcing the principle of least privilege for service accounts running Oracle HTTP Server can reduce the potential impact if an exploit occurs by limiting the file system and database permissions available to the process. Regular auditing of access logs should be conducted to identify any signs of unauthorized data modification or exfiltration that may have occurred prior to remediation.