{"id":"CVE-2026-87419","kind":"vulnerability","aliases":["CVE-2026-87419"],"related":[],"title":"Oracle Service Bus: low-privileged HTTP user can take over the server","description":"Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Core component that a low-privileged user can trigger over HTTP. A successful attack gives the attacker full takeover of the service bus, with high confidentiality, integrity and availability impact.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Service Bus","fixed":["October 2026 CPU patch (version string not public)"],"affected":"12.2.1.4.0, 14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle-fusion-middleware","oracle-service-bus","runtime","self-hosted"],"not_affected_if":["auth-required","default-config"],"how_to_check":"Check your installed Oracle Service Bus version (12.2.1.4.0 or 14.1.2.0.0 are affected), e.g. run OPatch lsinventory in the Fusion Middleware home and look for the October 2026 CPU patch. If it is missing, you are exposed. Check whether OSB HTTP ports are reachable from untrusted networks.","fix":"Apply the Oracle October 2026 Critical Patch Update for Oracle Fusion Middleware / Service Bus (patch numbers are in My Oracle Support, not public). Workaround, partial only: restrict HTTP access to the OSB endpoints to trusted networks or VPN.","status":"open","published_at":"2026-10-20T22:20:20+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-23T22:34:32+00:00","updated_at":"2026-10-24T00:00:29+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T22:34:32Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Oracle Service Bus: low-privileged HTTP user can take over the server","impact":"high","summary":"Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Core component that a low-privileged user can trigger over HTTP. A successful attack gives the attacker full takeover of the service bus, with high confidentiality, integrity and availability impact.","category":"runtime","who_cares":["oracle-service-bus","oracle-fusion-middleware","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"attacker takes over the Service Bus server and its data","analyst_note":"Check Oracle's Critical Patch Update advisory for patch version and any workaround; the sources give no fix or detection steps.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000487,"input_tokens":3077,"output_tokens":359,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Oracle's Critical Patch Update advisory for patch version and any workaround; the sources give no fix or detection steps.","search":"'-2026':15A,18A '-87419':16A,19A '/av':143C '12.2.1.4.0':38B,96C '14.1.2.0.0':40B,98C '3.1':130C,142C '8.8':133C 'access':108C 'affect':94C 'allow':102C 'attack':60B,63B,105C,117C 'avail':75B,137C 'base':131C 'bus':3A,22A,30B,37B,69B,82C,115C,128C 'compon':47B,88C 'compromis':112C 'confidenti':72B,134C 'contain':41B 'core':46B,89C 'cve':14A,17A 'cvss':129C,139C,141C 'easili':99C 'exploit':100C 'flaw':43B 'full':64B 'fusion':25B,86C 'give':61B 'h':151C 'h/a':150C 'h/i':149C 'high':71B 'host':34B 'http':7A,57B,110C 'impact':76B,138C 'integr':73B,135C 'l/pr':145C 'l/ui':146C 'low':5A,51B,103C 'low-privileg':4A,50B 'middlewar':26B,87C 'n/ac':144C 'n/s':147C 'network':107C 'oracl':1A,24B,28B,35B,80C,85C,113C,126C 'oracle':20A 'oracle-fusion-middlewar':23B 'oracle-service-bus':27B 'privileg':6A,52B,104C 'product':83C 'result':122C 'runtim':31B 'score':132C 'self':33B 'self-host':32B 'server':13A 'servic':2A,29B,36B,68B,81C,114C,127C 'service':21A 'success':59B,116C 'support':90C 'take':10A 'takeov':65B,124C 'trigger':55B 'u/c':148C 'user':8A,53B 'vector':140C 'version':91C 'via':109C 'vulner':77C,101C,120C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87419","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87419","severity":null,"published_at":"2026-10-20T22:20:20+00:00","modified_at":"2026-10-21T18:45:11+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-87419:565","url":null,"severity":null,"published_at":"2026-10-24T00:00:29+00:00","modified_at":"2026-10-24T00:00:29+00:00","first_seen_at":"2026-10-24T00:00:29+00:00","fetched_at":"2026-10-24T00:00:29+00:00","note":"Oracle CPU Oct 2026 (2026-10-20) fixes it; Oracle publishes no patch version strings outside MOS. CVE.org confirms affected 12.2.1.4.0/14.1.2.0.0, CVSS 8.8 PR:L. Armis says 'unauthenticated' but vector says low privileges; I trust the vector. No X chatter, no PoC or exploitation known."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2301,"url":"https://www.cve.org/CVERecord?id=CVE-2026-87419","title":"CVE Record: CVE-2026-87419","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}