---
id: "CVE-2026-87364"
kind: "vulnerability"
aliases: ["CVE-2026-87364"]
title: "Oracle Service Bus: low-privilege network attacker can take over server"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Oracle Service Bus", "fixed": ["unknown: October 2026 CPU patch"], "affected": "12.2.1.4.0, 14.1.2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["oracle-fusion-middleware", "oracle-service-bus", "runtime", "self-hosted", "weblogic"]
not_affected_if: ["auth-required", "managed-hosting"]
published_at: "2026-10-20T22:20:14+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-24T00:00:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87364", "first_seen_at": "2026-10-23T21:57:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:00:28+00:00"}]
---

# Oracle Service Bus: low-privilege network attacker can take over server

Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0 (Fusion Middleware, Core component) have a flaw that a low-privileged user can reach over HTTP, leading to takeover of the Service Bus server. CVSS 3.1 8.8. Fixed in the Oracle October 2026 Critical Patch Update. No known exploitation or public PoC.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Service Bus affected 12.2.1.4.0, 14.1.2.0.0 fixed unknown: October 2026 CPU patch

## How to check

Find your Oracle Service Bus version, e.g. OPatch lsinventory in the Fusion Middleware home or the WebLogic console. 12.2.1.4.0 or 14.1.2.0.0 without the October 2026 CPU patch is exposed. Also check whether Service Bus HTTP endpoints are reachable by low-privilege accounts.

## Fix

Apply the Oracle October 2026 CPU patch for Oracle Service Bus / Fusion Middleware. The exact patch number is in Oracle's Patch Availability Document (My Oracle Support login). Meanwhile restrict network access to Service Bus HTTP endpoints and review low-privilege accounts.

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87364
- 2026-10-24T00:00:28+00:00 analyst — Fixed in Oracle CPU Oct 2026 (cpuoct2026.html, 2026-10-20); CVE.org gives CVSS 8.8, affected 12.2.1.4.0 and 14.1.2.0.0. No fixed version number public; patch number is in the MOS Patch Availability Document (login needed). No exploitation, KEV or PoC found; X not searched.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-87364 https://www.cve.org/CVERecord?id=CVE-2026-87364

## From the sources

Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_