---
id: "CVE-2026-91419"
kind: "vulnerability"
aliases: ["CVE-2026-91419"]
title: "Oracle HTTP Server: OSSL module flaw lets local users take over server"
severity: "high"
cvss: 7.8
epss: 0.00145
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["java", "oracle-fusion-middleware", "oracle-http-server", "runtime", "self-hosted"]
not_affected_if: ["managed-hosting", "no-local-logon"]
published_at: "2026-10-20T22:20:45+00:00"
first_seen_at: "2026-10-23T21:57:26+00:00"
updated_at: "2026-10-25T12:38:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91419", "first_seen_at": "2026-10-23T21:57:26+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91419", "first_seen_at": "2026-10-25T12:38:52+00:00"}]
---

# Oracle HTTP Server: OSSL module flaw lets local users take over server

Oracle HTTP Server in Oracle Fusion Middleware 12.2.1.4.0 has a flaw in its OSSL module. A low-privileged local user with logon to the host can fully compromise the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the Oracle HTTP Server version under Fusion Middleware 12.2.1.4.0 with the installed opatch or the Oracle Fusion Middleware home (`unknown` for the exact command in the sources)
- Check whether local accounts beyond administrators can log on to the host running Oracle HTTP Server

## Fix

- Apply the Oracle Critical Patch Update fix for CVE-2026-91419 to Oracle HTTP Server 12.2.1.4.0 (the exact patch number is unknown from the sources)
- Restrict local logon to the host to administrators only until patched

## Timeline

- 2026-10-23T21:57:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91419
- 2026-10-25T12:38:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91419

## From the sources

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HTTP Server executes to compromise Oracle HTTP Server.  Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_