Oracle HTTP Server CVE-2026-60431

Exploitation targets the mod_proxy component of Oracle HTTP Server, so the OHS instance must have proxy functionality in use (reverse or forward proxying to back-end/origin systems) and be reachable over HTTP by the attacker - that is the concrete prerequisite drawn from the component and description. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or special client privilege is required against affected versions 12.2.1.4.0 and 14.1.2.0.0. Limiting factors that reduce real-world exposure: only these two OHS releases are listed, the impact is confidentiality-only (no data modification or service disruption), and the value of the attack depends on there being sensitive back-end resources behind the proxy for the scope-change to expose; OHS instances not performing proxying or not network-exposed are far lower risk.

Signals are moderately concerning but not emergency-tier. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6) means network-reachable, low-complexity, unauthenticated exploitation with no user interaction and cross-boundary confidentiality loss - an attractive, easily-automatable target. Offsetting this: impact is confidentiality-only (no integrity or availability), there is no integrity/RCE consequence, it is not in CISA KEV, no public POC has been identified, and no EPSS score was supplied in the input, so real-world exploitation probability cannot be quantified. No SSVC decision data was provided. The 'Authentication Bypass' tag and the description's 'unauthorized access to critical data' are directionally consistent with the confidentiality-heavy vector, so signals do not conflict; the main uncertainty is the absent CWE and EPSS, which prevents precise weaponization forecasting. Net: a genuine high-priority patch for internet- or partner-facing OHS instances, but data-exposure rather than takeover.

An attacker with only network HTTP access to an internet- or partner-facing Oracle HTTP Server sends a crafted request that abuses the mod_proxy routing/forwarding logic to reach a back-end or internal resource it should not, returning confidential data from that other system without any credentials. Because AC:L/PR:N/UI:N makes the attack low-complexity and unauthenticated, it is readily scriptable against exposed OHS endpoints; no public POC is currently identified, so exploitation would require the attacker to independently develop the request.