---
id: "CVE-2026-87420"
kind: "vulnerability"
aliases: ["CVE-2026-87420"]
title: "Oracle Service Bus: low-privilege network user can take over server"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Oracle Service Bus", "fixed": ["unknown: October 2026 CPU patch"], "affected": "14.1.2.0.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["infrastructure", "oracle-fusion-middleware", "oracle-service-bus", "runtime", "self-hosted", "weblogic"]
not_affected_if: ["managed-hosting", "not-14.1.2.0.0"]
published_at: "2026-10-20T22:20:20+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-23T23:59:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87420", "first_seen_at": "2026-10-23T21:57:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:59:28+00:00"}]
---

# Oracle Service Bus: low-privilege network user can take over server

Oracle Service Bus 14.1.2.0.0 (Fusion Middleware, Core component) has a flaw that a low-privileged user can reach over HTTP. A successful attack takes over the Service Bus server. CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:L/UI:N). Oracle fixed it in the October 2026 Critical Patch Update.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Service Bus affected 14.1.2.0.0 fixed unknown: October 2026 CPU patch

## How to check

Find your Oracle Service Bus version, for example with OPatch lsinventory in the Fusion Middleware home or in the WebLogic console. Version 14.1.2.0.0 without the October 2026 CPU patch is exposed. Also check whether the Service Bus HTTP endpoints can be reached by low-privileged accounts.

## Fix

Apply the Oracle Critical Patch Update October 2026 patch for Oracle Service Bus / Fusion Middleware. Oracle publishes the exact patch number in its Patch Availability Document, which needs a My Oracle Support login. Until then, restrict network access to Service Bus HTTP endpoints and review low-privilege accounts.

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87420
- 2026-10-23T23:59:28+00:00 analyst — Fixed in Oracle CPU October 2026 (cpuoct2026.html, 2026-10-20); CVE.org record gives CVSS 8.8 and affected 14.1.2.0.0. Advisory page lists no fixed version number, only a patch availability document (My Oracle Support login). No exploitation or PoC seen; no X posts. Sibling CVEs CVE-2026-87419 and CVE-2026-87369 hit the same product, including 12.2.1.4.0.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-87420 https://www.cve.org/CVERecord?id=CVE-2026-87420

## From the sources

Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core).   The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus.  Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_