Oracle HTTP Server Flaw CVE-2026-87347 Rated Critical by NVD
A critical vulnerability in Oracle HTTP Server allows network attackers to compromise data integrity and confidentiality via the OSSL Module.
Key points
- CVE-2026-87347 carries a CVSS 9.6 score, indicating severe risk to confidentiality and integrity.
- Oracle HTTP Server versions 12.2.1.4.0 and 14.1.2.0.0 within Oracle Fusion Middleware are affected.
- Low-privileged attackers with network access via HTTP can exploit the OSSL Module flaw.
The National Vulnerability Database has recorded CVE-2026-87347 as a critical security flaw in Oracle HTTP Server. This vulnerability resides within the OSSL Module component of the Oracle Fusion Middleware suite. Security researchers and administrators are now aware of the risk associated with these specific software versions.
The flaw allows a low-privileged attacker with network access via HTTP to compromise the server. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data. Attackers may also gain complete access to all data accessible by the Oracle HTTP Server instance.
Technical Severity and Scope
The National Vulnerability Database assigns a CVSS 3.1 Base Score of 9.6 to this vulnerability. This rating classifies the issue as critical due to high impacts on confidentiality and integrity. The CVSS vector indicates that the attack vector is network-based and requires low complexity.
Although the vulnerability is contained within Oracle HTTP Server, attacks may significantly impact additional products. The scope change means that compromising the HTTP server can expose data beyond its immediate boundaries. This amplifies the potential damage from a successful intrusion attempt.
Affected Versions
Only specific supported versions of Oracle Fusion Middleware are affected by this vulnerability. The Oracle HTTP Server product in version 12.2.1.4.0 is vulnerable to exploitation. Additionally, the Oracle HTTP Server product in version 14.1.2.0.0 is also affected by this flaw.
Organizations running other versions of the software are not listed as affected in this record. Administrators must verify their current installations against these two specific version numbers. Failure to identify these versions may leave critical infrastructure exposed to network-based attacks.
What should you do?
Security teams should immediately audit their environments for the presence of the affected Oracle HTTP Server versions. Network monitoring should be increased to detect unusual HTTP traffic patterns that may indicate exploitation attempts. Access controls should be reviewed to limit network exposure of these servers.
What to do and how to stay safe: Oracle
- Inventory all systems running Oracle Fusion Middleware to identify instances of versions 12.2.1.4.0 and 14.1.2.0.0.
- Monitor HTTP traffic logs for anomalous requests targeting the OSSL Module component of affected servers.
- Restrict network access to Oracle HTTP Server instances to only trusted sources until further guidance is available.
- Prepare to apply updates once the vendor provides a confirmed patch for CVE-2026-87347.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Oracle products are affected by CVE-2026-87347?
The Oracle HTTP Server product within Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0, is affected.
What is the severity rating of this vulnerability?
The National Vulnerability Database rates CVE-2026-87347 as critical with a CVSS 3.1 Base Score of 9.6.
Can an attacker exploit this flaw remotely?
Yes, a low-privileged attacker with network access via HTTP can exploit this vulnerability remotely.
