{"id":"CVE-2026-91419","kind":"vulnerability","aliases":["CVE-2026-91419"],"related":[],"title":"Oracle HTTP Server: OSSL module flaw lets local users take over server","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HTTP Server executes to compromise Oracle HTTP Server.  Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle HTTP Server in Oracle Fusion Middleware 12.2.1.4.0 has a flaw in its OSSL module. A low-privileged local user with logon to the host can fully compromise the server.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","oracle-fusion-middleware","oracle-http-server","runtime","self-hosted"],"not_affected_if":["managed-hosting","no-local-logon"],"how_to_check":"- Confirm the Oracle HTTP Server version under Fusion Middleware 12.2.1.4.0 with the installed opatch or the Oracle Fusion Middleware home (`unknown` for the exact command in the sources)\n- Check whether local accounts beyond administrators can log on to the host running Oracle HTTP Server","fix":"- Apply the Oracle Critical Patch Update fix for CVE-2026-91419 to Oracle HTTP Server 12.2.1.4.0 (the exact patch number is unknown from the sources)\n- Restrict local logon to the host to administrators only until patched","status":"open","published_at":"2026-10-20T22:20:45+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","triaged_at":"2026-10-25T03:08:40+00:00","updated_at":"2026-10-25T03:08:40+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T03:08:40Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for CVE-2026-91419 to Oracle HTTP Server 12.2.1.4.0 (the exact patch number is unknown from the sources)\n- Restrict local logon to the host to administrators only until patched","reach":"local","title":"Oracle HTTP Server: OSSL module flaw lets local users take over server","impact":"high","summary":"Oracle HTTP Server in Oracle Fusion Middleware 12.2.1.4.0 has a flaw in its OSSL module. A low-privileged local user with logon to the host can fully compromise the server.","category":"runtime","nicknames":[],"who_cares":["oracle-fusion-middleware","oracle-http-server","self-hosted","java"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker takes over the server, reads and changes its data","analyst_note":"Find the Oracle Security Alert or CPU advisory for CVE-2026-91419 to get the patch number and the exact affected builds.","how_to_check":"- Confirm the Oracle HTTP Server version under Fusion Middleware 12.2.1.4.0 with the installed opatch or the Oracle Fusion Middleware home (`unknown` for the exact command in the sources)\n- Check whether local accounts beyond administrators can log on to the host running Oracle HTTP Server","needs_analyst":true,"not_affected_if":["managed-hosting","no-local-logon"],"who_is_affected":"Teams running Oracle HTTP Server 12.2.1.4.0 from Oracle Fusion Middleware, where local users can log on to the same infrastructure. The attack requires local access and low privileges, not network access from the internet, so exposure depends on who holds shell or logon accounts on those hosts.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000674,"input_tokens":3468,"output_tokens":655,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-91419':15A,18A '/av':134C '12.2.1.4.0':39B,84C '3.1':121C,133C '7.8':124C 'affect':82C 'allow':88C 'attack':91C,108C 'avail':128C 'base':122C 'compon':74C 'compromis':60B,103C 'confidenti':125C 'cve':13A,16A 'cvss':120C,130C,132C 'easili':85C 'execut':101C 'exploit':86C 'flaw':6A,42B 'fulli':59B 'fusion':22B,37B,72C 'h':142C 'h/a':141C 'h/i':140C 'host':31B,57B 'http':2A,26B,33B,67C,99C,105C,118C 'impact':129C 'infrastructur':96C 'integr':126C 'java':19B 'l/ac':135C 'l/pr':136C 'l/ui':137C 'let':7A 'local':8A,51B 'logon':54B,93C 'low':49B,89C 'low-privileg':48B 'middlewar':23B,38B,73C 'modul':5A,46B,76C 'n/s':138C 'oracl':1A,21B,25B,32B,36B,66C,71C,98C,104C,117C 'oracle-fusion-middlewar':20B 'oracle-http-serv':24B 'ossl':4A,45B,75C 'privileg':50B,90C 'product':69C 'result':113C 'runtim':28B 'score':123C 'self':30B 'self-host':29B 'server':3A,12A,27B,34B,62B,68C,100C,106C,119C 'success':107C 'support':78C 'take':10A 'takeov':115C 'u/c':139C 'user':9A,52B 'vector':131C 'version':79C 'vulner':63C,87C,111C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle HTTP Server 12.2.1.4.0 from Oracle Fusion Middleware, where local users can log on to the same infrastructure. The attack requires local access and low privileges, not network access from the internet, so exposure depends on who holds shell or logon accounts on those hosts.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91419","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91419","severity":null,"published_at":"2026-10-20T22:20:45+00:00","modified_at":"2026-10-23T21:17:25+00:00","first_seen_at":"2026-10-23T21:57:26+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}