Description
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus. Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Service Takeover
Action: Immediate Patch
AI Analysis

Impact

The Oracle Service Bus Core component contains a flaw that permits a low‑privileged attacker with network access via HTTP to compromise the service. Successful exploitation results in full takeover of Oracle Service Bus and loss of confidentiality, integrity, and availability. The vulnerability is rated high severity with a CVSS v3.1 score of 8.8 indicating substantial impact.

Affected Systems

Oracle Corporation’s Oracle Service Bus is affected when deployed in versions 12.2.1.4.0 and 14.1.2.0.0. Users running these releases should verify deployment status and apply patches.

Risk and Exploitability

The CVSS base score of 8.8 demonstrates a high‑risk condition, while the EPSS score of less than 1 percent implies a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Based on the description it is inferred that the attack vector is network‑based via HTTP, requiring only low privileges and no user interaction. If an attacker succeeds, they can send crafted HTTP requests to the exposed endpoints and gain control of the Oracle Service Bus.

Generated by OpenCVE AI on October 28, 2026 at 19:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the patch released in Oracle CPU October 2026 to address the vulnerability in versions 12.2.1.4.0 and 14.1.2.0.0.
  • Restrict inbound HTTP traffic to the Oracle Service Bus using firewall rules or access control lists, allowing connections only from trusted IP addresses.
  • Disable any unused administrative interfaces exposed over HTTP and enforce strong authentication mechanisms with logging enabled.

Generated by OpenCVE AI on October 28, 2026 at 19:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 20:15:00 +0000

Type Values Removed Values Added
Title Oracle Service Bus Core Vulnerability Enabling Low-Privilege HTTP Takeover

Wed, 28 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Low Privilege Remote Takeover in Oracle Service Bus via HTTP
Weaknesses CWE-284
CWE-862

Wed, 28 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-200
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Low Privilege Remote Takeover in Oracle Service Bus via HTTP
Weaknesses CWE-284
CWE-862

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus. Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle service Bus
CPEs cpe:2.3:a:oracle:service_bus:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:service_bus:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle service Bus
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Service Bus
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T13:50:14.208Z

Reserved: 2026-09-08T21:49:12.413Z

Link: CVE-2026-87359

cve-icon Vulnrichment

Updated: 2026-10-28T13:49:51.270Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:13.790

Modified: 2026-11-05T19:35:09.817

Link: CVE-2026-87359

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T20:00:18Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor