What is the CVSS score of CVE-2026-60431?

CVE-2026-60431 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle HTTP Server are affected by CVE-2026-60431?

Oracle HTTP Server, a core proxy component in Oracle Fusion Middleware used by enterprises for mission-critical business applications, contains a vulnerability allowing unauthenticated remote…

How to fix or mitigate CVE-2026-60431?

Within 24 hours, identify and document all systems running Oracle HTTP Server 12.2.1.4.0 or 14.1.2.0.0, enable detailed logging of HTTP Server proxy traffic to detect anomalous access patterns, and review proxy configurations to understand which back-end systems are exposed. Within 7 days, implement network segmentation restricting direct access to back-end systems and deploy Web Application Firewall (WAF) rules to detect and block requests attempting to access out-of-scope resources through the proxy. Within 30 days, monitor for and apply the Oracle Critical Patch Update as released by vendor; if patch availability extends beyond 30 days, continue interim mitigations and increase monitoring intensity until official patch deployment is completed.

Oracle HTTP Server CVE-2026-60431

EUVD-2026-46829 HIGH

Information Exposure (CWE-200)

2026-07-21 secalert_us@oracle.com

GHSA-mr3v-jwh6-mmp4

Authentication Bypass Oracle Information Disclosure Http Server

8.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

8.6 HIGH

Network-reachable, low-complexity, unauthenticated proxy abuse with cross-boundary data exposure justifies AV:N/AC:L/PR:N and S:C/C:H; no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:41 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.6

DescriptionCVE.org

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_proxy). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. While the vulnerability is in Oracle HTTP Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0 (Oracle Fusion Middleware, mod_proxy component) lets an unauthenticated remote attacker over HTTP read critical data and, because of a scope change, reach data belonging to other back-end products the proxy fronts. The confidentiality-only impact combined with S:C strongly indicates a proxy-side request-forwarding/SSRF-class weakness that exposes internal resources rather than a code-execution flaw. Addressed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle HTTP Server (OHS) is Oracle's Apache-derived web tier for Fusion Middleware, and the affected component mod_proxy is the reverse/forward proxy module that relays client requests to back-end origin servers (WebLogic, application servers, internal services). The CVSS scope change (S:C) coupled with high confidentiality but no integrity or availability impact is the classic signature of a proxy that can be coerced into fetching or exposing resources beyond its intended trust boundary - i.e. server-side request forgery or request-routing bypass, the reason 'attacks may significantly impact additional products.' No CWE was assigned by NVD/Oracle, so the exact weakness class is inferred from the vector and the mod_proxy component rather than confirmed; the vendor tag 'Authentication Bypass' suggests the proxy layer can be induced to serve or route to data that should require authentication.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html) to both affected releases (12.2.1.4.0 and 14.1.2.0.0); Oracle CPUs bundle the specific patch numbers per product, so consult that advisory for the exact OHS patch IDs since no discrete fix version string was provided in the input. As compensating controls until patching, restrict and validate mod_proxy configuration by removing or tightly scoping ProxyPass/ProxyPassReverse and any forward-proxy (ProxyRequests) directives, deny proxying to internal or metadata address ranges, and place a WAF or reverse-proxy allowlist in front of OHS to constrain which back-end hosts and URL paths can be reached - with the trade-off that over-restrictive proxy rules can break legitimate application routing to WebLogic/back-end tiers, so stage changes in test first. Also front internet-facing OHS with network ACLs limiting inbound HTTP to trusted sources where feasible.