Live › vulnerability › CVE-2026-91473
Go to dashboardOracle HTTP Server 12.2.1.4.0 in Oracle Fusion Middleware has a flaw in its Web Listener component. A local user with low privileges and logon to the host can take over the server, with full impact on confidentiality, integrity and availability.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Oracle HTTP Server 12.2.1.4.0 from Oracle Fusion Middleware on servers where people or services have local logon accounts. The attack needs local access to the host, not network access alone, so a server where only the web listener is reachable from outside and no other accounts exist is less exposed. The sources do not say which patch resolves it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Oracle HTTP Server | vendor | 12.2.1.4.0 | – |
$ORACLE_HOME/OPatch/opatch lspatches in the Fusion Middleware home that holds OHS and compare against the October 2026 CPU patch for OHS in the MOS Patch Availability Document; OHS 12.2.1.4.0 without it is exposed.12.2.1.4.0, as listed in the MOS Fusion Middleware Patch Availability DocumentEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HTTP Server executes to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
This page as .md · .json · in your agent: get_signal("CVE-2026-91473")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.