---
id: "CVE-2026-91473"
kind: "vulnerability"
aliases: ["CVE-2026-91473"]
title: "Oracle HTTP Server: local low-privilege user can take over the server"
severity: "high"
cvss: 7.8
epss: 0.00135
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Oracle HTTP Server", "fixed": [], "affected": "12.2.1.4.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["local-privilege", "oracle-fusion-middleware", "oracle-http-server", "runtime", "self-hosted"]
not_affected_if: ["no-local-logon", "other-version", "patched-october-2026-cpu"]
published_at: "2026-10-20T22:20:50+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91473", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:24:50+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-91473", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Oracle HTTP Server: local low-privilege user can take over the server

Oracle HTTP Server 12.2.1.4.0 in Oracle Fusion Middleware has a flaw in its Web Listener component. A local user with low privileges and logon to the host can take over the server, with full impact on confidentiality, integrity and availability.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle HTTP Server affected 12.2.1.4.0 fixed ?

## How to check

- Run `$ORACLE_HOME/OPatch/opatch lspatches` in the Fusion Middleware home that holds OHS and compare against the October 2026 CPU patch for OHS in the MOS Patch Availability Document; OHS 12.2.1.4.0 without it is exposed.
- List who has shell or logon accounts on OHS hosts. The attack is local (AV:L, PR:L), so hosts with no untrusted local users are much less exposed.

## Fix

Apply the Oracle Critical Patch Update of October 2026 for Oracle HTTP Server / Fusion Middleware 12.2.1.4.0, as listed in the MOS Fusion Middleware Patch Availability Document. The exact patch number is unknown here (needs a My Oracle Support login). No config workaround is documented.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91473
- 2026-10-25T03:24:50+00:00 analyst — Oracle October 2026 CPU (cpuoct2026) lists Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0 under Fusion Middleware; this CVE's record (Oracle CNA) names only 12.2.1.4.0. Exact patch number is in the MOS Fusion Middleware patch availability doc (login required), not readable; no exploitation or PoC found. Nothing marked verified.
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-91473

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] CVE Record: CVE-2026-91473 https://www.cve.org/CVERecord?id=CVE-2026-91473

## From the sources

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener).   The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HTTP Server executes to compromise Oracle HTTP Server.  Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_