Oracle HTTP Server CVE-2026-34291

Exploitation requires network access to the Oracle HTTP Server over HTTP and no authentication (CVSS PR:N/UI:N), and affects Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0. The key limiting factor is the CVSS High attack complexity (AC:H): Oracle states the vulnerability is 'difficult to exploit,' meaning success depends on conditions outside the attacker's control that are not publicly detailed in the advisory. The realized cross-product impact depends on the scope-change condition - that the OHS instance actually fronts or shares trust with additional Oracle products - so a standalone or tightly isolated OHS deployment limits the 'significantly impact additional products' outcome. Availability is not affected (A:N). Oracle has not published the precise configuration or request pattern that triggers the flaw, so the exact preconditions behind AC:H should be confirmed with the vendor.

The signals here conflict in an instructive way and argue against treating this as a top-priority emergency. Strong-severity signals: CVSS 8.7 with network vector, no privileges, no user interaction (AV:N/PR:N/UI:N), a scope change (S:C), and full confidentiality and integrity impact (C:H/I:H); CISA SSVC also rates Technical Impact as 'total.' Weak-exploitation signals: the CVSS attack complexity is High (AC:H), meaning exploitation requires conditions the attacker does not control; EPSS is very low at 0.03% (9th percentile); SSVC marks Exploitation as 'none' and Automatable as 'no'; and there is no public exploit identified at time of analysis and no CISA KEV listing. The net picture is a high-impact-but-hard-to-exploit access-control flaw more likely to be used in targeted, skilled attacks than in mass automated campaigns. Note one caveat to verify: the CWE-284 root cause and 'Authentication Bypass' tag suggest an access-control weakness, yet AC:H implies non-trivial preconditions - the exact trigger conditions are not disclosed by Oracle and should be confirmed against the vendor advisory.

A remote, unauthenticated attacker sends specially crafted HTTP requests to an internet-reachable Oracle HTTP Server instance, abusing the improper access-control flaw to bypass intended authorization and read or modify critical data the server can reach. Because of the scope change, the attacker may leverage the compromised front-end to reach and tamper with back-end Fusion Middleware resources. No public exploit is identified at time of analysis, and the CVSS High attack complexity implies the attacker must satisfy specific non-default or timing/configuration conditions to succeed.