{"id":"CVE-2026-87359","kind":"vulnerability","aliases":["CVE-2026-87359"],"related":[],"title":"Oracle Service Bus: low-privilege HTTP attacker can take over server","description":"Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0 (Core component): a low-privileged attacker with HTTP access can take over the service bus (CVSS 3.1 8.8, CWE-269). Fixed in Oracle's October 2026 Critical Patch Update. No exploitation or public PoC reported.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Service Bus","fixed":[],"affected":"12.2.1.4.0, 14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle-fusion-middleware","oracle-service-bus","runtime","self-hosted"],"not_affected_if":["default-config","managed-hosting"],"how_to_check":"Find your Service Bus version (WebLogic OPatch: ORACLE_HOME/OPatch/opatch lsinventory, look for Oracle Service Bus 12.2.1.4.0 or 14.1.2.0.0) and check whether the October 2026 CPU patch is listed. Exposed if OSB HTTP endpoints are reachable by any low-privileged user.","fix":"Apply the Oracle Service Bus patch from the October 2026 Critical Patch Update (see the Fusion Middleware Patch Availability Document on My Oracle Support). The exact patch number was not readable from public pages. Until patched, restrict network access to OSB HTTP endpoints and review low-privilege accounts.","status":"open","published_at":"2026-10-20T22:20:13+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-23T22:34:35+00:00","updated_at":"2026-10-24T00:00:35+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T22:34:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Service Bus: low-privilege HTTP attacker can take over server","impact":"high","summary":"Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Core component that a low-privilege user can trigger over HTTP. A successful attack gives the attacker full takeover of the service bus, with high confidentiality, integrity and availability impact.","category":"runtime","who_cares":["oracle-service-bus","oracle-fusion-middleware","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker takes over the Oracle Service Bus server and its data","analyst_note":"Find Oracle's Critical Patch Update advisory for the patch version and any detection guidance; check https://nvd.nist.gov/vuln/detail/CVE-2026-87359 for references.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000501,"input_tokens":3077,"output_tokens":387,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory for the patch version and any detection guidance; check https://nvd.nist.gov/vuln/detail/CVE-2026-87359 for references.","search":"'-2026':14A,17A '-269':60B '-87359':15A,18A '/av':142C '12.2.1.4.0':37B,95C '14.1.2.0.0':39B,97C '2026':66B '3.1':57B,129C,141C '8.8':58B,132C 'access':49B,107C 'affect':93C 'allow':101C 'attack':8A,46B,104C,116C 'avail':136C 'base':130C 'bus':3A,21A,29B,36B,55B,81C,114C,127C 'compon':41B,87C 'compromis':111C 'confidenti':133C 'core':40B,88C 'critic':67B 'cve':13A,16A 'cvss':56B,128C,138C,140C 'cwe':59B 'easili':98C 'exploit':71B,99C 'fix':61B 'fusion':24B,85C 'h':150C 'h/a':149C 'h/i':148C 'host':33B 'http':7A,48B,109C 'impact':137C 'integr':134C 'l/pr':144C 'l/ui':145C 'low':5A,44B,102C 'low-privileg':4A,43B 'middlewar':25B,86C 'n/ac':143C 'n/s':146C 'network':106C 'octob':65B 'oracl':1A,23B,27B,34B,63B,79C,84C,112C,125C 'oracle':19A 'oracle-fusion-middlewar':22B 'oracle-service-bus':26B 'patch':68B 'poc':74B 'privileg':6A,45B,103C 'product':82C 'public':73B 'report':75B 'result':121C 'runtim':30B 'score':131C 'self':32B 'self-host':31B 'server':12A 'servic':2A,28B,35B,54B,80C,113C,126C 'service':20A 'success':115C 'support':89C 'take':10A,51B 'takeov':123C 'u/c':147C 'updat':69B 'vector':139C 'version':90C 'via':108C 'vulner':76C,100C,119C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87359","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87359","severity":null,"published_at":"2026-10-20T22:20:13+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-87359:568","url":null,"severity":null,"published_at":"2026-10-24T00:00:35+00:00","modified_at":"2026-10-24T00:00:35+00:00","first_seen_at":"2026-10-24T00:00:35+00:00","fetched_at":"2026-10-24T00:00:35+00:00","note":"Oracle CPU Oct 2026 (20 Oct) fixes it; CVE record gives affected 12.2.1.4.0 and 14.1.2.0.0, CVSS 8.8, CWE-269. No fixed version number or PoC found; the patch is a MOS patch per the CPU Patch Availability Document (login needed). No exploitation reported (not in KEV). No public discussion searched on X."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2305,"url":"https://www.cve.org/CVERecord?id=CVE-2026-87359","title":"CVE Record: CVE-2026-87359","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}