{"id":"CVE-2026-91473","kind":"vulnerability","aliases":["CVE-2026-91473"],"related":[],"title":"Oracle HTTP Server: local low-privilege user can take over the server","description":"Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HTTP Server executes to compromise Oracle HTTP Server.  Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle HTTP Server 12.2.1.4.0 in Oracle Fusion Middleware has a flaw in its Web Listener component. A local user with low privileges and logon to the host can take over the server, with full impact on confidentiality, integrity and availability.","severity":"high","cvss":7.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle HTTP Server","fixed":[],"affected":"12.2.1.4.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["local-privilege","oracle-fusion-middleware","oracle-http-server","runtime","self-hosted"],"not_affected_if":["no-local-logon","other-version","patched-october-2026-cpu"],"how_to_check":"- Run `$ORACLE_HOME/OPatch/opatch lspatches` in the Fusion Middleware home that holds OHS and compare against the October 2026 CPU patch for OHS in the MOS Patch Availability Document; OHS 12.2.1.4.0 without it is exposed.\n- List who has shell or logon accounts on OHS hosts. The attack is local (AV:L, PR:L), so hosts with no untrusted local users are much less exposed.","fix":"Apply the Oracle Critical Patch Update of October 2026 for Oracle HTTP Server / Fusion Middleware 12.2.1.4.0, as listed in the MOS Fusion Middleware Patch Availability Document. The exact patch number is unknown here (needs a My Oracle Support login). No config workaround is documented.","status":"open","published_at":"2026-10-20T22:20:50+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T03:08:35+00:00","updated_at":"2026-10-25T03:24:50+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-25T03:08:35Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Oracle HTTP Server: local low-privilege user can take over the server","impact":"high","summary":"Oracle HTTP Server 12.2.1.4.0 in Oracle Fusion Middleware has a flaw in its Web Listener component. A local user with low privileges and logon to the host can take over the server, with full impact on confidentiality, integrity and availability.","category":"runtime","nicknames":[],"who_cares":["oracle-fusion-middleware","oracle-http-server","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Low-privilege local user takes over the Oracle HTTP Server process","analyst_note":"Find the Oracle Critical Patch Update advisory for this CVE and confirm the fixed patch level for 12.2.1.4.0, plus any configuration that changes exposure.","how_to_check":"- Check the installed version of Oracle HTTP Server under the Fusion Middleware home, for example with `opatch lspatches` in the Oracle home, and confirm whether it is `12.2.1.4.0`\n- Identify hosts where Oracle HTTP Server runs and who holds shell or logon accounts on them","needs_analyst":true,"not_affected_if":["no-local-logon","other-version"],"who_is_affected":"Teams running Oracle HTTP Server 12.2.1.4.0 from Oracle Fusion Middleware on servers where people or services have local logon accounts. The attack needs local access to the host, not network access alone, so a server where only the web listener is reachable from outside and no other accounts exist is less exposed. The sources do not say which patch resolves it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000651,"input_tokens":3466,"output_tokens":608,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Oracle Critical Patch Update advisory for this CVE and confirm the fixed patch level for 12.2.1.4.0, plus any configuration that changes exposure.","search":"'-2026':15A,18A '-91473':16A,19A '/av':149C '12.2.1.4.0':41B,99C '3.1':136C,148C '7.8':139C 'affect':97C 'allow':103C 'attack':106C,123C 'avail':77B,143C 'base':137C 'compon':53B,89C 'compromis':118C 'confidenti':74B,140C 'cve':14A,17A 'cvss':135C,145C,147C 'easili':100C 'execut':116C 'exploit':101C 'flaw':48B 'full':71B 'fusion':28B,44B,87C 'h':157C 'h/a':156C 'h/i':155C 'host':37B,64B 'http':2A,21A,32B,39B,82C,114C,120C,133C 'impact':72B,144C 'infrastructur':111C 'integr':75B,141C 'l/ac':150C 'l/pr':151C 'l/ui':152C 'listen':52B,91C 'local':4A,24B,55B 'local-privileg':23B 'logon':61B,108C 'low':6A,58B,104C 'low-privileg':5A 'middlewar':29B,45B,88C 'n/s':153C 'oracl':1A,27B,31B,38B,43B,81C,86C,113C,119C,132C 'oracle':20A 'oracle-fusion-middlewar':26B 'oracle-http-serv':30B 'privileg':7A,25B,59B,105C 'product':84C 'result':128C 'runtim':34B 'score':138C 'self':36B 'self-host':35B 'server':3A,13A,22A,33B,40B,69B,83C,115C,121C,134C 'success':122C 'support':93C 'take':10A,66B 'takeov':130C 'u/c':154C 'user':8A,56B 'vector':146C 'version':94C 'vulner':78C,102C,126C 'web':51B,90C","nicknames":[],"mitigations":[],"who_affected":"Teams running Oracle HTTP Server 12.2.1.4.0 from Oracle Fusion Middleware on servers where people or services have local logon accounts. The attack needs local access to the host, not network access alone, so a server where only the web listener is reachable from outside and no other accounts exist is less exposed. The sources do not say which patch resolves it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91473","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91473","severity":null,"published_at":"2026-10-20T22:20:50+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-91473:711","url":null,"severity":null,"published_at":"2026-10-25T03:24:50+00:00","modified_at":"2026-10-25T03:24:50+00:00","first_seen_at":"2026-10-25T03:24:50+00:00","fetched_at":"2026-10-25T03:24:50+00:00","note":"Oracle October 2026 CPU (cpuoct2026) lists Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0 under Fusion Middleware; this CVE's record (Oracle CNA) names only 12.2.1.4.0. Exact patch number is in the MOS Fusion Middleware patch availability doc (login required), not readable; no exploitation or PoC found. Nothing marked verified."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":3153,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91473","title":"CVE Record: CVE-2026-91473","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}