Description
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Service Bus. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Service Bus. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Published: 2026-10-20
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Patch Immediately
AI Analysis

Impact

A flaw in Oracle Service Bus allows an unauthenticated attacker with network access to send a crafted HTTP request that triggers a hang or crash of the service, resulting in a repeatable denial of service. The vulnerability is a failure to properly validate or process incoming requests, leading to an availability compromise. The CVSS v3.1 base score of 7.5 reflects a high availability impact.

Affected Systems

Oracle Service Bus versions 12.2.1.4.0 and 14.1.2.0.0 are affected. Users deploying these releases should confirm that the instance matches one of the identified version strings.

Risk and Exploitability

The CVSS base score of 7.5 indicates a high risk to availability. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw over the network via HTTP without authentication, making the attack path straightforward for internal or external threat actors who can reach the Service Bus instance.

Generated by OpenCVE AI on October 21, 2026 at 14:58 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the most recent Oracle CPU patch for Oracle Service Bus
  • Restrict HTTP access to Oracle Service Bus to trusted networks or enforce firewall rules that block unsolicited traffic
  • Configure a network or application firewall, or reverse proxy, to detect and block repetitive malformed HTTP requests, mitigating crash attempts

Generated by OpenCVE AI on October 21, 2026 at 14:58 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Denial of Service in Oracle Service Bus
Weaknesses CWE-400

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Service Bus. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Service Bus. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
First Time appeared Oracle
Oracle service Bus
CPEs cpe:2.3:a:oracle:service_bus:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:service_bus:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle service Bus
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Oracle Service Bus
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-22T18:50:22.340Z

Reserved: 2026-09-08T21:49:12.414Z

Link: CVE-2026-87369

cve-icon Vulnrichment

Updated: 2026-10-22T18:42:05.777Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:14.853

Modified: 2026-11-05T19:38:22.220

Link: CVE-2026-87369

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T19:00:16Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption