EUVD-2026-46777
GHSA-pgwq-c6w2-4hh7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote HTTP exploitation with no user interaction and full takeover justifies AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H; no cross-system scope change stated so S:U.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Apache Plugin). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Articles & Coverage 1
AnalysisAI
Full compromise of Oracle HTTP Server (Oracle Fusion Middleware) is possible via the bundled Apache Plugin (mod_wl/proxy) component in supported versions 12.2.1.4.0 and 14.1.2.0.0, allowing a network-based unauthenticated attacker to take over the server over HTTP. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, this is one of the highest-severity issues in Oracle's July 2026 Critical Patch Update. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only network HTTP access to an Oracle HTTP Server instance running the affected Apache Plugin component in version 12.2.1.4.0 or 14.1.2.0.0 - no authentication, no privileges, and no user interaction (AV:N/AC:L/PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All available severity signals point the same direction: the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes remote, low-complexity, unauthenticated exploitation with full CIA impact - the maximum practical risk profile short of a scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the OHS HTTP listener sends a specially crafted HTTP request to the Apache Plugin request-handling path and, with no authentication or user interaction, triggers the flaw to gain control of the OHS process. From that foothold on an internet-facing web tier, the attacker can read or alter proxied traffic and pivot toward backend WebLogic/Fusion Middleware systems. … |
| Remediation | Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected Oracle HTTP Server releases 12.2.1.4.0 and 14.1.2.0.0 - this is Patch available per vendor advisory; the input does not include a discrete fixed build number, so obtain the exact patch/bundle from My Oracle Support per the CPU matrix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct a complete inventory of Oracle HTTP Server deployments; identify all systems running versions 12.2.1.4.0 or 14.1.2.0.0; map direct network exposure and egress paths. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Http Server
View allA crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.4
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denia
The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directiv
mod_session_dbd.c in the mod_session_dbd module in the Apache HTTP Server before 2.4.5 proceeds with save operations for
The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from t
The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which al
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_ssl may dereference a NULL pointer when third-party mod
In Apache HTTP Server versions 2.4.0 to 2.4.23, mod_session_crypto was encrypting its data/cookie using the configured c
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, mod_mime can read one byte past the end of a buffer when se
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today