{"id":"CVE-2026-87420","kind":"vulnerability","aliases":["CVE-2026-87420"],"related":[],"title":"Oracle Service Bus: low-privilege network user can take over server","description":"Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Service Bus 14.1.2.0.0 (Fusion Middleware, Core component) has a flaw that a low-privileged user can reach over HTTP. A successful attack takes over the Service Bus server. CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:L/UI:N). Oracle fixed it in the October 2026 Critical Patch Update.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Service Bus","fixed":["unknown: October 2026 CPU patch"],"affected":"14.1.2.0.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["infrastructure","oracle-fusion-middleware","oracle-service-bus","runtime","self-hosted","weblogic"],"not_affected_if":["managed-hosting","not-14.1.2.0.0"],"how_to_check":"Find your Oracle Service Bus version, for example with OPatch lsinventory in the Fusion Middleware home or in the WebLogic console. Version 14.1.2.0.0 without the October 2026 CPU patch is exposed. Also check whether the Service Bus HTTP endpoints can be reached by low-privileged accounts.","fix":"Apply the Oracle Critical Patch Update October 2026 patch for Oracle Service Bus / Fusion Middleware. Oracle publishes the exact patch number in its Patch Availability Document, which needs a My Oracle Support login. Until then, restrict network access to Service Bus HTTP endpoints and review low-privilege accounts.","status":"open","published_at":"2026-10-20T22:20:20+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-23T22:34:37+00:00","updated_at":"2026-10-23T23:59:28+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T22:34:37Z","model":"claude-haiku-5-5","output":{"fix":"unknown; check Oracle's Critical Patch Update advisory for the patched release.","reach":"network","title":"Oracle Service Bus: low-privilege network user can take over server","impact":"high","summary":"Oracle Service Bus 14.1.2.0.0, part of Oracle Fusion Middleware (Core component), can be attacked over HTTP by a user with low privileges. A successful attack lets the attacker take over the Service Bus server.","category":"runtime","who_cares":["oracle-service-bus","oracle-fusion-middleware","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker takes over the server, losing confidentiality, integrity and availability.","analyst_note":"","how_to_check":"Check the installed Oracle Service Bus version; 14.1.2.0.0 is the affected release listed by NVD.","needs_analyst":false,"not_affected_if":["not-14.1.2.0.0"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.001089,"input_tokens":3066,"output_tokens":1565,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory for the CVE-2026-87420 patch version and the affected-version list at https://nvd.nist.gov/vuln/detail/CVE-2026-87420 and Oracle's security alerts page.","search":"'-2026':14A,17A '-87420':15A,18A '/av':152C '14.1.2.0.0':39B,107C '2026':83B '3.1':67B,139C,151C '8.8':71B,142C 'access':117C 'affect':105C 'allow':111C 'attack':59B,114C,126C 'av':72B 'avail':146C 'base':68B,140C 'bus':3A,21A,30B,38B,64B,92C,124C,137C 'compon':43B,98C 'compromis':121C 'confidenti':143C 'core':42B,99C 'critic':84B 'cve':13A,16A 'cvss':66B,138C,148C,150C 'easili':108C 'exploit':109C 'fix':78B 'flaw':46B 'fusion':25B,40B,96C 'h':160C 'h/a':159C 'h/i':158C 'host':34B 'http':56B,119C 'impact':147C 'infrastructur':22B 'integr':144C 'l/pr':74B,154C 'l/ui':75B,155C 'low':5A,50B,112C 'low-privileg':4A,49B 'middlewar':26B,41B,97C 'n':76B 'n/ac':73B,153C 'n/s':156C 'network':7A,116C 'octob':82B 'oracl':1A,24B,28B,36B,77B,90C,95C,122C,135C 'oracle':19A 'oracle-fusion-middlewar':23B 'oracle-service-bus':27B 'patch':85B 'privileg':6A,51B,113C 'product':93C 'reach':54B 'result':131C 'runtim':31B 'score':69B,141C 'self':33B 'self-host':32B 'server':12A,65B 'servic':2A,29B,37B,63B,91C,123C,136C 'service':20A 'success':58B,125C 'support':101C 'take':10A,60B 'takeov':133C 'u/c':157C 'updat':86B 'user':8A,52B 'vector':149C 'version':102C 'via':118C 'vulner':87C,110C,129C 'weblog':35B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87420","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87420","severity":null,"published_at":"2026-10-20T22:20:20+00:00","modified_at":"2026-10-21T18:45:11+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-87420:564","url":null,"severity":null,"published_at":"2026-10-23T23:59:28+00:00","modified_at":"2026-10-23T23:59:28+00:00","first_seen_at":"2026-10-23T23:59:28+00:00","fetched_at":"2026-10-23T23:59:28+00:00","note":"Fixed in Oracle CPU October 2026 (cpuoct2026.html, 2026-10-20); CVE.org record gives CVSS 8.8 and affected 14.1.2.0.0. Advisory page lists no fixed version number, only a patch availability document (My Oracle Support login). No exploitation or PoC seen; no X posts. Sibling CVEs CVE-2026-87419 and CVE-2026-87369 hit the same product, including 12.2.1.4.0."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2294,"url":"https://www.cve.org/CVERecord?id=CVE-2026-87420","title":"CVE Record: CVE-2026-87420","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}