CVE-2026-87359 in Service Bus
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus. Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Core component of Oracle Service Bus, a critical middleware product in the Oracle Fusion Middleware suite. This security flaw affects specific supported versions, namely 12.2.1.4.0 and 14.1.2.0.0, indicating that even recently maintained releases are susceptible to exploitation. The nature of this vulnerability is particularly concerning because it allows for remote code execution or system compromise without the need for user interaction or high-level privileges. An attacker with low privileged access who has network connectivity via HTTP can exploit this flaw to gain unauthorized control over the Oracle Service Bus environment. This represents a significant escalation from standard privilege levels, as the successful exploitation leads directly to a complete takeover of the affected service bus instance.
From a technical perspective, the vulnerability enables an adversary to compromise the integrity and confidentiality of the system by leveraging network-accessible HTTP endpoints. The ease of exploitation suggests that the underlying code flaw may involve improper input validation or authentication bypass mechanisms within the core processing logic. Because the attack vector is network-based and requires only low privileges, it poses a severe risk in environments where internal users or services have limited access rights but can reach the middleware layer. The ability to take over Oracle Service Bus implies that an attacker could potentially intercept, modify, or inject messages flowing through the bus, disrupt service availability by crashing processes, or exfiltrate sensitive data processed by the middleware.
The operational impact of this vulnerability is substantial, as reflected in its high severity rating. With a CVSS 3.1 Base Score of 8.8, categorized as High Severity, the risk to organizational infrastructure is considerable. The vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) details that the attack has an Attack Vector of Network, meaning it can be exploited remotely over a network such as the Internet or an intranet. It requires Low Attack Complexity and Low Privileges for exploitation, with no User Interaction required. The scope is Unchanged, but the impacts on Confidentiality, Integrity, and Availability are all High. This triad of high-impact consequences means that successful exploitation can lead to full data exposure, unauthorized modification of business logic or messages, and denial of service conditions that disrupt critical business operations dependent on Oracle Service Bus.
In terms of industry standards classification, this vulnerability aligns with CWE categories related to authentication bypasses or improper input handling in web services, such as CWE-287 (Improper Authentication) or CWE-20 (Improper Input Validation), depending on the specific technical root cause within the core component. From a tactical standpoint, it maps to MITRE ATT&CK techniques involving Initial Access via Network Service Exploitation and potentially Privilege Escalation if the low privilege account gains higher system control through this flaw. Attackers would likely leverage automated tools to scan for vulnerable instances on accessible networks, exploiting the lack of complex requirements to achieve persistent access or lateral movement within the enterprise network.
Mitigation strategies must prioritize immediate remediation due to the high exploitability and impact. The primary defense is applying the latest security patches provided by Oracle for versions 12.2.1.4.0 and 14.1.2.0.0. Organizations should verify their deployment inventory against these specific version numbers and apply vendor-recommended updates as soon as they are available in a test environment before production rollout. In the interim, if patching is not immediately feasible, network segmentation strategies should be employed to restrict HTTP access to Oracle Service Bus components only from trusted IP ranges or internal subnets that do not include untrusted user segments. Additionally, implementing strict input validation at any proxied layers and enforcing strong authentication mechanisms can help reduce the attack surface. Regular vulnerability scanning focused on middleware components is essential to detect such exposures early, ensuring that low-privileged accounts cannot leverage this flaw to compromise critical infrastructure services.