---
id: "CVE-2026-87419"
kind: "vulnerability"
aliases: ["CVE-2026-87419"]
title: "Oracle Service Bus: low-privileged HTTP user can take over the server"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Oracle Service Bus", "fixed": ["October 2026 CPU patch (version string not public)"], "affected": "12.2.1.4.0, 14.1.2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["oracle-fusion-middleware", "oracle-service-bus", "runtime", "self-hosted"]
not_affected_if: ["auth-required", "default-config"]
published_at: "2026-10-20T22:20:20+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-24T00:00:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87419", "first_seen_at": "2026-10-23T21:57:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:00:29+00:00"}]
---

# Oracle Service Bus: low-privileged HTTP user can take over the server

Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0 contain a flaw in the Core component that a low-privileged user can trigger over HTTP. A successful attack gives the attacker full takeover of the service bus, with high confidentiality, integrity and availability impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Service Bus affected 12.2.1.4.0, 14.1.2.0.0 fixed October 2026 CPU patch (version string not public)

## How to check

Check your installed Oracle Service Bus version (12.2.1.4.0 or 14.1.2.0.0 are affected), e.g. run OPatch lsinventory in the Fusion Middleware home and look for the October 2026 CPU patch. If it is missing, you are exposed. Check whether OSB HTTP ports are reachable from untrusted networks.

## Fix

Apply the Oracle October 2026 Critical Patch Update for Oracle Fusion Middleware / Service Bus (patch numbers are in My Oracle Support, not public). Workaround, partial only: restrict HTTP access to the OSB endpoints to trusted networks or VPN.

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87419
- 2026-10-24T00:00:29+00:00 analyst — Oracle CPU Oct 2026 (2026-10-20) fixes it; Oracle publishes no patch version strings outside MOS. CVE.org confirms affected 12.2.1.4.0/14.1.2.0.0, CVSS 8.8 PR:L. Armis says 'unauthenticated' but vector says low privileges; I trust the vector. No X chatter, no PoC or exploitation known.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-87419 https://www.cve.org/CVERecord?id=CVE-2026-87419

## From the sources

Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_