EUVD-2026-105933
GHSA-2r3p-fj38-899j
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach HTTP endpoint of OUI Framework
-
ExploitSend crafted malicious request
-
ExecutionTrigger hang or repeatable crash
-
ImpactComplete denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No authentication, user interaction, or special attacker-side configuration is required (AV:N/AC:L/PR:N/UI:N). The key limiting factor is deployment exposure: the NextGen OUI Framework's HTTP endpoint must be network-reachable by the attacker - for an installer/lifecycle-management component this is often internal or short-lived rather than permanently internet-facing, which materially narrows real-world reachability. Impact is confined to availability (complete DoS); no confidentiality or integrity consequence, so it cannot be chained into data theft or code execution on its own. Affected only on versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0, and 15.1.1.0.0. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes a remotely reachable, low-complexity, unauthenticated flaw with no user interaction - attractive on paper. However, the impact is strictly availability (C:N/I:N/A:H): this is a denial-of-service only, with no data exposure or code execution, which caps its strategic value to an attacker. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so exploitation-probability and automatability signals cannot be weighed - the only intelligence is Oracle's own advisory. The signals are consistent rather than conflicting (network DoS matches the HTTP vector in the description), but the practical risk hinges on whether the affected installer/lifecycle-management framework actually exposes a network-reachable HTTP endpoint in a given deployment, which is not confirmed. Net: a genuine but availability-limited issue - patch in the normal Oracle CPU cycle rather than emergency priority, barring evidence the component is internet-facing. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker who can reach the NextGen OUI Framework's HTTP interface sends a crafted request that drives the service into a hang or repeatable crash, producing a complete denial of service of the lifecycle-management/installer framework. Because CVSS marks AC:L/PR:N/UI:N, no credentials, special timing, or victim interaction are needed. No public exploit identified at time of analysis, so this remains a theoretical/vendor-reported scenario. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthenticated denial of service in Oracle Global Lifecycle Management NextGen OUI Framework (the NextGen Installer component) lets a remote attacker who can reach the product's HTTP endpoint hang or repeatedly crash it, wiping out availability of the installer/lifecycle-management service. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (base 7.5), so no credentials, user interaction, or special attacker-side setup are needed - the practical constraint is exposure, since installer endpoints are typically internal or short-lived rather than permanently internet-facing. There are no confidentiality or integrity impacts, so the flaw cannot be chained into data theft or code execution on its own; no public exploit code was identified at time of analysis, and no EPSS or CISA KEV signal was supplied. Affected releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and 15.1.1.0.0.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html) to every installation of Oracle Global Lifecycle Management NextGen OUI Framework on 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 or 15.1.1.0.0; patch availability is confirmed by the vendor advisory, but the exact patched build numbers must be read from the CPU document for each affected release line rather than assumed. Because the flaw is unauthenticated and network-reachable by design, the highest-value compensating control is reducing reachability: bind the NextGen Installer HTTP endpoint to localhost or a management-only interface, and firewall-restrict its port to the provisioning hosts and operators that actually need it - the trade-off is that remote and automated install/provisioning workflows will break until the rules are updated. Where the installer is only used during build or upgrade windows, stop the listener outside those windows and tear down installer hosts after provisioning completes; this eliminates the attack surface entirely at the cost of ad-hoc reinstalls. Do not rely on WAF or rate limiting as a primary control - the vector is AC:L and a single low-complexity request pattern is sufficient - and monitor/auto-restart the service so that a successful hang or crash is detected quickly. There is no integrity or confidentiality exposure, so incident response can be scoped to availability and service-restart actions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Global Lifecycle Management NextGen OUI Framework is the modernized Oracle Universal Installer / lifecycle tooling that ships inside Oracle Fusion Middleware and presents an HTTP-based listener used to drive installation and provisioning operations. The vulnerability is a pure availability defect: a remote, unauthenticated request pattern over HTTP drives the component into a hang or a repeatable crash, giving an attacker a complete denial of service against the framework. No CWE identifier was assigned by the reporter, but the behavior maps to the resource-exhaustion / uncontrolled-resource-consumption class (CWE-400, with CWE-770 as the closest specific child) - the flaw is not memory corruption, injection, or an access-control bypass, so nothing about it enables code execution, privilege escalation, or data exposure. Both the NVD reference and the ENISA EUVD record (EUVD-2026-105933) point to the Oracle Critical Patch Update for October 2026 as the authoritative source; no CPE strings were included in the feed data, so exact product/version fingerprints must be matched against Oracle's own affected-version matrix rather than automated CPE matching, which will under-detect this product in scanner inventories.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description confirms unauthenticated HTTP-reachable, easily exploitable DoS, so AV:N/AC:L/PR:N/UI:N; impact is availability-only, hence C:N/I:N/A:H and scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Installer). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, 14.1.2.1.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Global Lifecycle Management NextGen OUI Framework. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Global Lifecycle Management NextGen OUI Framework. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Executive ViewAI
Oracle Global Lifecycle Management NextGen OUI Framework (the NextGen Installer component) carries an unauthenticated remote denial-of-service flaw that can hang or repeatedly crash the installer/lifecycle-management service, with no confidentiality or integrity exposure. Because the affected component underpins how our teams install, provision, and patch Oracle estates, disruption could stall maintenance windows and delay remediation work if the HTTP endpoint is reachable by untrusted networks. Leadership should care primarily about operational continuity and exposure hygiene, not data loss, since impact is confined to availability and the practical risk depends on whether these typically internal, short-lived endpoints are unnecessarily exposed.
No vendor-released patch identified at time of analysis: restrict the NextGen Installer HTTP endpoint to trusted administrative networks or a bastion/jump host, front it with an authenticating reverse proxy or WAF enforcing connection and request-rate limits, stop or disable the installer/lifecycle-management service outside active maintenance windows, and monitor for repeated hangs or crash-restart loops with an automated restart and recovery runbook in place.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB