CVE-2026-91473 in HTTP Server
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HTTP Server executes to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Web Listener component of Oracle HTTP Server, a critical element of the Oracle Fusion Middleware suite version 12.2.1.4.0. This flaw represents a significant security risk because it allows for remote code execution or system compromise under specific conditions that are relatively easy to exploit. The core issue stems from insufficient validation or handling of input data within the Web Listener, which serves as the entry point for HTTP requests before they are processed by backend application servers. When an attacker interacts with this component, the lack of proper sanitization allows malicious payloads to bypass standard security controls embedded in the middleware architecture.
From a technical perspective, the vulnerability is classified under CWE-20 Improper Input Validation and potentially CWE-78 OS Command Injection depending on the specific mechanism exploited by the Web Listener. The attack vector requires low privileges but does not require user interaction, making it particularly dangerous for environments where internal network segmentation relies heavily on authentication boundaries rather than strict access controls at every layer of the application stack. An attacker with valid logon credentials to the infrastructure hosting Oracle HTTP Server can leverage this flaw to execute arbitrary commands or manipulate server state without needing elevated privileges initially. This aligns closely with MITRE ATT&CK technique T1059 Command and Scripting Interpreter, as successful exploitation often leads to the execution of system-level commands that compromise the underlying operating environment.
The operational impact of a successful exploit is severe, resulting in a complete takeover of the Oracle HTTP Server instance. With a CVSS 3.1 Base Score of 7.8, the vulnerability affects all three pillars of the CIA triad: confidentiality, integrity, and availability. An attacker who gains control over this component can potentially exfiltrate sensitive data processed by the middleware, modify configuration files or application logic to maintain persistence, and disrupt service availability for downstream applications relying on Oracle HTTP Server as a reverse proxy or load balancer. This level of compromise effectively neutralizes the security perimeter provided by the web server layer, exposing backend systems to further lateral movement within the enterprise network.
Mitigation strategies must focus on immediate patching and enhanced access control measures. Organizations running version 12.2.1.4.0 should apply the latest available patches from Oracle that address this specific vulnerability in the Web Listener component. In addition to software updates, it is critical to enforce strict least-privilege principles for accounts with logon access to the infrastructure hosting Oracle HTTP Server. Network segmentation should be reviewed to ensure that even authenticated users on lower-privileged networks cannot easily reach the management interfaces or internal endpoints of the web server. Furthermore, implementing Web Application Firewall rules can help detect and block exploit attempts targeting known patterns associated with this vulnerability until patches are fully deployed across all affected environments.