A critical (CVSS 9.6), easily exploitable vulnerability in the OSSL Module of Oracle HTTP Server lets a low-privileged attacker with network access over HTTP compromise the server and read or modify critical data.
What Is It
CVE-2026-87347 is a vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware, in the OSSL Module component. Oracle describes it as easily exploitable. An attacker needs only low privileges and network access via HTTP to compromise Oracle HTTP Server. No user interaction is required.
The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N. The flaw is in Oracle HTTP Server, but the scope is marked as changed, so attacks may significantly impact additional products.
Why It Matters
Successful exploitation can result in:
- Unauthorized creation, deletion or modification of critical data, or of all data Oracle HTTP Server can access
- Unauthorized access to critical data, or complete access to all data Oracle HTTP Server can access
Confidentiality and integrity impacts are both rated High. Availability impact is None. The score combines low attack complexity, network reachability and a scope change, which gives a Critical rating of 9.6 (exploitability subscore 3.1, impact subscore 5.8).
The supplied CISA KEV entry is empty. KEV does not currently confirm active exploitation of this CVE, and the supplied sources contain no exploitation reports.
What's Vulnerable
| Vendor | Product | Affected Versions |
|---|---|---|
| Oracle Corporation | Oracle HTTP Server (Oracle Fusion Middleware, OSSL Module) | 12.2.1.4.0, 14.1.2.0.0 |
Oracle lists these as the affected supported versions. The NVD record lists no CPE entries yet.
Patch Status
The NVD record was published on 2026-10-20 and has the status "Received," meaning NVD has not yet analyzed it. Its only reference is Oracle's October 2026 Critical Patch Update advisory. Administrators running the affected versions should review that advisory for remediation guidance and apply the relevant updates.
There is no CISA KEV entry, so no KEV-mandated required action or due date applies at this time.
Sources
- Oracle Critical Patch Update Advisory – October 2026
- NVD – CVE-2026-87347
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)