{"id":"CVE-2026-87364","kind":"vulnerability","aliases":["CVE-2026-87364"],"related":[],"title":"Oracle Service Bus: low-privilege network attacker can take over server","description":"Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0 (Fusion Middleware, Core component) have a flaw that a low-privileged user can reach over HTTP, leading to takeover of the Service Bus server. CVSS 3.1 8.8. Fixed in the Oracle October 2026 Critical Patch Update. No known exploitation or public PoC.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Service Bus","fixed":["unknown: October 2026 CPU patch"],"affected":"12.2.1.4.0, 14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle-fusion-middleware","oracle-service-bus","runtime","self-hosted","weblogic"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"Find your Oracle Service Bus version, e.g. OPatch lsinventory in the Fusion Middleware home or the WebLogic console. 12.2.1.4.0 or 14.1.2.0.0 without the October 2026 CPU patch is exposed. Also check whether Service Bus HTTP endpoints are reachable by low-privilege accounts.","fix":"Apply the Oracle October 2026 CPU patch for Oracle Service Bus / Fusion Middleware. The exact patch number is in Oracle's Patch Availability Document (My Oracle Support login). Meanwhile restrict network access to Service Bus HTTP endpoints and review low-privilege accounts.","status":"open","published_at":"2026-10-20T22:20:14+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-23T22:34:34+00:00","updated_at":"2026-10-24T00:00:28+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T22:34:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Service Bus: low-privilege network attacker can take over server","impact":"high","summary":"Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Core component reachable over HTTP. An attacker with a low-privilege account and network access can take over the Oracle Service Bus instance.","category":"runtime","who_cares":["oracle-service-bus","oracle-fusion-middleware","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker takes over the Service Bus server, affecting confidentiality, integrity and availability","analyst_note":"Find the Oracle Critical Patch Update advisory for CVE-2026-87364 to get the patched version and the affected-version list; the NVD text names only 12.2.1.4.0 and 14.1.2.0.0.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["auth-required"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000501,"input_tokens":3077,"output_tokens":387,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Oracle Critical Patch Update advisory for CVE-2026-87364 to get the patched version and the affected-version list; the NVD text names only 12.2.1.4.0 and 14.1.2.0.0.","search":"'-2026':14A,17A '-87364':15A,18A '/av':150C '12.2.1.4.0':38B,103C '14.1.2.0.0':40B,105C '2026':74B '3.1':67B,137C,149C '8.8':68B,140C 'access':115C 'affect':101C 'allow':109C 'attack':8A,112C,124C 'avail':144C 'base':138C 'bus':3A,21A,29B,37B,64B,89C,122C,135C 'compon':44B,95C 'compromis':119C 'confidenti':141C 'core':43B,96C 'critic':75B 'cve':13A,16A 'cvss':66B,136C,146C,148C 'easili':106C 'exploit':80B,107C 'fix':69B 'flaw':47B 'fusion':24B,41B,93C 'h':158C 'h/a':157C 'h/i':156C 'host':33B 'http':57B,117C 'impact':145C 'integr':142C 'known':79B 'l/pr':152C 'l/ui':153C 'lead':58B 'low':5A,51B,110C 'low-privileg':4A,50B 'middlewar':25B,42B,94C 'n/ac':151C 'n/s':154C 'network':7A,114C 'octob':73B 'oracl':1A,23B,27B,35B,72B,87C,92C,120C,133C 'oracle':19A 'oracle-fusion-middlewar':22B 'oracle-service-bus':26B 'patch':76B 'poc':83B 'privileg':6A,52B,111C 'product':90C 'public':82B 'reach':55B 'result':129C 'runtim':30B 'score':139C 'self':32B 'self-host':31B 'server':12A,65B 'servic':2A,28B,36B,63B,88C,121C,134C 'service':20A 'success':123C 'support':97C 'take':10A 'takeov':60B,131C 'u/c':155C 'updat':77B 'user':53B 'vector':147C 'version':98C 'via':116C 'vulner':84C,108C,127C 'weblog':34B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87364","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87364","severity":null,"published_at":"2026-10-20T22:20:14+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-87364:567","url":null,"severity":null,"published_at":"2026-10-24T00:00:28+00:00","modified_at":"2026-10-24T00:00:28+00:00","first_seen_at":"2026-10-24T00:00:28+00:00","fetched_at":"2026-10-24T00:00:28+00:00","note":"Fixed in Oracle CPU Oct 2026 (cpuoct2026.html, 2026-10-20); CVE.org gives CVSS 8.8, affected 12.2.1.4.0 and 14.1.2.0.0. No fixed version number public; patch number is in the MOS Patch Availability Document (login needed). No exploitation, KEV or PoC found; X not searched."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2300,"url":"https://www.cve.org/CVERecord?id=CVE-2026-87364","title":"CVE Record: CVE-2026-87364","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}