{"id":"CVE-2026-87369","kind":"vulnerability","aliases":["CVE-2026-87369"],"related":[],"title":"Oracle Service Bus: unauthenticated HTTP request can crash or hang server","description":"Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Service Bus. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).","summary":"Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0 contain a flaw that lets an unauthenticated remote attacker send HTTP requests that hang or repeatedly crash the service. The impact is denial of service only; the CVSS vector shows no confidentiality or integrity loss.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","oracle-fusion-middleware","oracle-service-bus","vendor"],"not_affected_if":["no-network-exposure","other-versions"],"how_to_check":"- Check the installed Oracle Service Bus version under the Oracle Fusion Middleware home (unknown exact command in sources)\n- Confirm whether the instance is reachable from untrusted networks over HTTP","fix":"- Apply the Oracle Critical Patch Update fix for Oracle Service Bus (patch identifiers unknown in sources)\n- Move to a supported fixed release if one is listed in the Oracle advisory (unknown in sources)","status":"open","published_at":"2026-10-20T22:20:14+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T03:18:47+00:00","updated_at":"2026-10-25T03:18:47+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-25T03:18:47Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle Service Bus (patch identifiers unknown in sources)\n- Move to a supported fixed release if one is listed in the Oracle advisory (unknown in sources)","reach":"internet","title":"Oracle Service Bus: unauthenticated HTTP request can crash or hang server","impact":"medium","summary":"Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0 contain a flaw that lets an unauthenticated remote attacker send HTTP requests that hang or repeatedly crash the service. The impact is denial of service only; the CVSS vector shows no confidentiality or integrity loss.","category":"vendor","nicknames":[],"who_cares":["oracle-service-bus","oracle-fusion-middleware","java"],"confidence":0.7,"needs_auth":"no","worst_case":"Service hangs or repeatedly crashes, causing complete denial of service.","analyst_note":"Confirm the fixed patch version and affected endpoints in the Oracle Security Alert for CVE-2026-87369.","how_to_check":"- Check the installed Oracle Service Bus version under the Oracle Fusion Middleware home (unknown exact command in sources)\n- Confirm whether the instance is reachable from untrusted networks over HTTP","needs_analyst":true,"not_affected_if":["other-versions","no-network-exposure"],"who_is_affected":"Organizations running Oracle Service Bus 12.2.1.4.0 or 14.1.2.0.0 with HTTP endpoints reachable over the network. The sources do not describe a specific configuration; internal-only deployments with no network exposure carry less risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000661,"input_tokens":3471,"output_tokens":627,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-87369':14A,17A '/av':142C '12.2.1.4.0':31B,88C '14.1.2.0.0':33B,90C '3.1':132C,141C '7.5':135C 'abil':116C 'access':99C 'affect':86C 'allow':94C 'attack':42B,96C,108C 'avail':136C 'base':133C 'bus':3A,26B,30B,74C,106C,130C 'caus':118C 'complet':125C 'compon':80C 'compromis':103C 'confidenti':65B 'contain':34B 'core':81C 'crash':8A,50B,124C 'cve':12A,15A 'cvss':61B,131C,138C,140C 'denial':56B 'dos':126C 'easili':91C 'exploit':92C 'flaw':36B 'frequent':122C 'fusion':21B,78C 'h':150C 'hang':10A,47B,120C 'http':5A,44B,101C 'impact':54B,137C 'integr':67B 'java':18B 'l/pr':144C 'let':38B 'loss':68B 'middlewar':22B,79C 'n/a':149C 'n/ac':143C 'n/i':148C 'n/s':146C 'n/ui':145C 'network':98C 'oracl':1A,20B,24B,28B,72C,77C,104C,128C 'oracle-fusion-middlewar':19B 'oracle-service-bus':23B 'product':75C 'remot':41B 'repeat':49B,123C 'request':6A,45B 'result':113C 'score':134C 'send':43B 'server':11A 'servic':2A,25B,29B,52B,58B,73C,105C,129C 'show':63B 'success':107C 'support':82C 'u/c':147C 'unauthent':4A,40B,95C 'unauthor':115C 'vector':62B,139C 'vendor':27B 'version':83C 'via':100C 'vulner':69C,93C,111C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle Service Bus 12.2.1.4.0 or 14.1.2.0.0 with HTTP endpoints reachable over the network. The sources do not describe a specific configuration; internal-only deployments with no network exposure carry less risk.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:14+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87369","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87369","severity":null,"published_at":"2026-10-20T22:20:14+00:00","modified_at":"2026-10-22T19:18:03+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}