---
id: "CVE-2026-87369"
kind: "vulnerability"
aliases: ["CVE-2026-87369"]
title: "Oracle Service Bus: unauthenticated HTTP request can crash or hang server"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["java", "oracle-fusion-middleware", "oracle-service-bus", "vendor"]
not_affected_if: ["no-network-exposure", "other-versions"]
published_at: "2026-10-20T22:20:14+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-25T03:18:47+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87369", "first_seen_at": "2026-10-23T21:57:25+00:00"}]
---

# Oracle Service Bus: unauthenticated HTTP request can crash or hang server

Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0 contain a flaw that lets an unauthenticated remote attacker send HTTP requests that hang or repeatedly crash the service. The impact is denial of service only; the CVSS vector shows no confidentiality or integrity loss.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Oracle Service Bus version under the Oracle Fusion Middleware home (unknown exact command in sources)
- Confirm whether the instance is reachable from untrusted networks over HTTP

## Fix

- Apply the Oracle Critical Patch Update fix for Oracle Service Bus (patch identifiers unknown in sources)
- Move to a supported fixed release if one is listed in the Oracle advisory (unknown in sources)

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87369

## From the sources

Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Service Bus. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_