Description
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus. Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Patch Immediately
AI Analysis

Impact

Vulnerability in the Oracle Service Bus component allows a low‑privileged attacker who has network access via HTTP to compromise the service bus. The impact includes a breach of confidentiality, integrity and availability, potentially enabling the attacker to take control of the system and access or modify all data and configuration.

Affected Systems

Affected versions are Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0 from Oracle Corporation.

Risk and Exploitability

The base CVSS score of 8.8 denotes high severity. The EPSS score of < 1% indicates a relatively low probability of exploitation currently, yet the vulnerability remains highly dangerous when exploited, as it can fully compromise the service bus and its data. The likely attack vector involves a low‑privileged attacker sending HTTP requests to the Service Bus.

Generated by OpenCVE AI on October 22, 2026 at 09:48 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle Security Patch that resolves CVE‑2026‑87419 immediately.
  • Restrict or block external HTTP traffic to the Service Bus by configuring firewalls or network segmentation.
  • Enforce strong authentication and authorization controls on the Service Bus management interfaces to ensure only privileged users can modify configuration.

Generated by OpenCVE AI on October 22, 2026 at 09:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 10:15:00 +0000

Type Values Removed Values Added
Title Oracle Service Bus Vulnerability Allows Low‑Privileged Network Attacker to Compromise Service

Thu, 22 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 01:00:00 +0000

Type Values Removed Values Added
Title Low Privileged HTTP Exploit Enables Full Compromise of Oracle Service Bus
Weaknesses CWE-284
CWE-287

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Title Low Privileged HTTP Exploit Enables Full Compromise of Oracle Service Bus
Weaknesses CWE-284
CWE-287
CWE-306

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus. Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle service Bus
CPEs cpe:2.3:a:oracle:service_bus:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:service_bus:14.1.2.0.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle service Bus
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Service Bus
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T14:10:37.330Z

Reserved: 2026-09-08T21:49:12.417Z

Link: CVE-2026-87419

cve-icon Vulnrichment

Updated: 2026-10-21T14:10:33.064Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:20:20.380

Modified: 2026-10-21T18:45:11.277

Link: CVE-2026-87419

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T19:15:10Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function