What is the CVSS score of CVE-2026-60363?

CVE-2026-60363 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle HTTP Server are affected by CVE-2026-60363?

Oracle HTTP Server versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical remote code execution vulnerability (CVSS 9.8) allowing unauthenticated attackers to achieve complete server compromise via…

How to fix or mitigate CVE-2026-60363?

Within 24 hours: Conduct a complete inventory of Oracle HTTP Server deployments; identify all systems running versions 12.2.1.4.0 or 14.1.2.0.0; map direct network exposure and egress paths. Within 7 days: Restrict HTTP access to affected servers through network segmentation, limiting connections to essential internal clients only; deploy Web Application Firewall rules blocking requests to the mod_wl proxy component; evaluate disabling the Apache proxy module (mod_wl) if operationally feasible. Within 30 days: Execute a patching or migration strategy-either plan an upgrade to patched versions or transition to alternative infrastructure; if affected systems remain in production, establish continuous automated log monitoring for exploitation attempts and schedule quarterly security assessments until the vulnerability is resolved.

Oracle HTTP Server CVE-2026-60363

EUVD-2026-46777 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-pgwq-c6w2-4hh7

Authentication Bypass Apache Oracle Http Server

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated remote HTTP exploitation with no user interaction and full takeover justifies AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H; no cross-system scope change stated so S:U.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:51 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Apache Plugin). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Articles & Coverage 1

News Critical RCE in Oracle HTTP Server Apache mod_wl Plugin - CVE-2026-60363 Jul 22, 2026

AnalysisAI

Full compromise of Oracle HTTP Server (Oracle Fusion Middleware) is possible via the bundled Apache Plugin (mod_wl/proxy) component in supported versions 12.2.1.4.0 and 14.1.2.0.0, allowing a network-based unauthenticated attacker to take over the server over HTTP. Rated CVSS 3.1 9.8 with high confidentiality, integrity, and availability impact, this is one of the highest-severity issues in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, but the low-complexity, no-privilege, no-interaction profile makes it a top-priority patch.

Technical ContextAI

Oracle HTTP Server (OHS) is Oracle's Apache HTTP Server derivative used as the web tier and reverse proxy front end for Oracle Fusion Middleware, WebLogic, and packaged Oracle applications. The flaw resides in the 'Apache Plugin' component - the module set (historically the mod_weblogic/WebLogic proxy plugin and related Apache request-handling code) that proxies and forwards HTTP requests to backend WebLogic managed servers. Because the defect is reachable directly over HTTP with no authentication and yields full 'takeover' of the OHS process, it most likely stems from a memory-safety or request-parsing/handling defect in the plugin's HTTP handling path. No CWE was assigned in the source data, so the precise weakness class (e.g., buffer overflow vs. request smuggling vs. injection) cannot be confirmed from the provided intelligence.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected Oracle HTTP Server releases 12.2.1.4.0 and 14.1.2.0.0 - this is Patch available per vendor advisory; the input does not include a discrete fixed build number, so obtain the exact patch/bundle from My Oracle Support per the CPU matrix. Because OHS is typically an internet-facing edge tier, prioritize patching immediately during the next maintenance window. If patching must be delayed, reduce exposure by placing OHS behind a WAF/reverse proxy that filters malformed HTTP to the plugin, restricting network reachability of the OHS listener to trusted upstreams, and considering temporary disabling of the WebLogic/Apache proxy plugin virtual hosts that are not required (trade-off: this breaks proxying to the backing WebLogic applications and may take services offline). Do not rely on authentication-based controls, as exploitation requires no credentials.