Oracle HTTP Server CVE-2026-60363

Exploitation requires only network HTTP access to an Oracle HTTP Server instance running the affected Apache Plugin component in version 12.2.1.4.0 or 14.1.2.0.0 - no authentication, no privileges, and no user interaction (AV:N/AC:L/PR:N/UI:N). The concrete prerequisite is that the vulnerable OHS deployment must expose the Apache Plugin (the WebLogic proxy/Apache request path) to the attacker. Limiting factors: only the two named supported versions are listed as affected, and real-world exposure depends on whether the OHS listener is internet-reachable versus restricted to internal upstreams; instances not using the Apache Plugin proxy configuration may not be exposed. Beyond version and reachability, no special non-default configuration is called out in the source data.

All available severity signals point the same direction: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes remote, low-complexity, unauthenticated exploitation with full CIA impact - the maximum practical risk profile short of a scope change. It is not in CISA KEV and no proof-of-concept is referenced, so there is no public exploit identified at time of analysis and no confirmed active exploitation. EPSS was not provided in the input and cannot be cited. The key tension is between the very high intrinsic exploitability (9.8, network-facing internet edge component) and the absence of any exploitation-in-the-wild evidence; Oracle CPU vulnerabilities in internet-facing middleware have historically drawn rapid exploit development, so this should be treated as a real, imminent priority rather than a theoretical high-CVSS item. Note the 'Information Disclosure' tag is narrower than the description's 'takeover'/full-impact claim - treat the CVSS full-compromise rating as authoritative and the tag as incomplete metadata.

An attacker who can reach the OHS HTTP listener sends a specially crafted HTTP request to the Apache Plugin request-handling path and, with no authentication or user interaction, triggers the flaw to gain control of the OHS process. From that foothold on an internet-facing web tier, the attacker can read or alter proxied traffic and pivot toward backend WebLogic/Fusion Middleware systems. No public proof-of-concept is referenced in the available data.