EUVD-2026-46835
GHSA-67jp-m3r7-6hq2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach OHS HTTPS listener over network
-
ExploitSend crafted request abusing mod_ssl
-
ExecutionBypass authentication check
-
ImpactAccess or modify server-accessible data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The exploitable surface is Oracle HTTP Server's mod_ssl (HTTPS/TLS) interface, so the server must be reachable over HTTP/HTTPS by the attacker - the CVSS vector AV:N/AC:L/PR:N/UI:N indicates no authentication, no user interaction, and low complexity against network-facing OHS instances running affected versions 12.2.1.4.0 or 14.1.2.0.0. The concrete prerequisite is an internet- or network-reachable OHS listener served by the vulnerable mod_ssl module; the primary limiting factor is network exposure - instances confined to trusted internal segments or fronted by an independent authenticating proxy are substantially harder to reach, and only the two named supported versions are confirmed affected in the input. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, base 9.1) describes a network-reachable, low-complexity, unauthenticated, no-user-interaction attack with high confidentiality and integrity impact and no availability impact - a genuinely high-priority profile. No EPSS score, SSVC decision, KEV entry, or POC was provided, so exploitation-in-the-wild probability cannot be quantified from the input; the absence of these signals means the urgency rests on the CVSS profile and the 'Authentication Bypass' tag rather than on confirmed exploitation. The lack of availability impact (A:N) is consistent with a data-access/authentication-bypass flaw rather than a denial-of-service. Because Oracle CPU advisories batch many issues and Oracle does not publish EPSS/KEV data itself, treat missing exploitation signals as unknown, not as low risk. |
| Exploit ScenarioDerived | An attacker who can reach an Oracle HTTP Server HTTPS endpoint over the network sends a crafted HTTPS request that abuses the mod_ssl authentication-bypass weakness, causing the server to treat the request as authorized without valid credentials. The attacker then reads, alters, or deletes data accessible to the server. No public POC was identified at time of analysis, but the low attack complexity and lack of required authentication make weaponization straightforward if exploit details emerge. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Unauthenticated compromise of Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0 (a Fusion Middleware component) is possible over the network via HTTP against the mod_ssl module, letting a remote attacker read, create, delete or modify all server-accessible data. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact but no availability impact, and tagged as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) makes it a high-priority patch.
RemediationAI
Apply the fixes delivered in the Oracle July 2026 Critical Patch Update per the advisory at https://www.oracle.com/security-alerts/cpujul2026.html, which is the primary and vendor-authoritative remediation for both affected releases (12.2.1.4.0 and 14.1.2.0.0); an exact fixed build number was not included in the input, so identify the specific CPU patch for your OHS version from that advisory. Patch available per vendor advisory. As interim compensating controls until patching, restrict network reachability of the OHS HTTPS listeners to trusted networks via firewall or ACLs, place the server behind a hardened reverse proxy or WAF that enforces authentication independently, and if client-certificate or mod_ssl-based access enforcement is used, audit and tighten those rules - noting that restricting listener exposure may break legitimate external clients and that a fronting proxy adds operational complexity and a new trust boundary. Because the flaw is an authentication bypass, do not rely on mod_ssl's own access controls as the mitigation.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle HTTP Server (OHS) is Oracle's web tier built on the Apache HTTP Server codebase and shipped as part of Oracle Fusion Middleware, commonly fronting WebLogic and other middleware deployments. The affected component is mod_ssl, the module responsible for terminating TLS/SSL connections and, in some deployments, performing client-certificate based authentication and access control. The 'Authentication Bypass' tag combined with mod_ssl as the flaw location points to a weakness in how TLS/SSL identity or access enforcement is handled, allowing a request to be treated as authorized without valid credentials. No CWE was assigned in the source data, so the precise root-cause class (e.g., improper authentication or improper access control) cannot be confirmed from the input.
Know when Http Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-reachable HTTP/mod_ssl auth bypass needs no credentials or interaction (AV:N/AC:L/PR:N/UI:N); full read/write to data gives C:H/I:H, no service disruption so A:N.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_ssl). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server accessible data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle HTTP Server versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical authentication bypass vulnerability in the mod_ssl module that allows unauthenticated remote attackers to read, modify, or delete server-accessible data. Organizations running these versions face immediate risk of data breach, integrity violation, and potential regulatory penalties. The trivial network exploitability (no credentials required) combined with the absence of a vendor patch creates urgent operational risk.
No vendor-released patch identified at time of analysis. Deploy interim defenses: (1) Network segmentation-restrict HTTP/HTTPS access to trusted internal IPs only; (2) Web Application Firewall-enable rules to detect mod_ssl exploitation patterns if signatures exist; (3) Disable mod_ssl-if not operationally required, disable the module to eliminate attack surface; (4) Backend authentication-enforce strong authentication on all data sources and applications behind the HTTP Server; (5) Enhanced logging-capture detailed HTTP request logs and mod_ssl activity to detect unauthorized access attempts; (6) Access restrictions-implement role-based controls to limit what data can be accessed or modified through the HTTP Server.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Http Server
View allA crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user.4.4
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user
The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for
Race condition in the mod_status module in the Apache HTTP Server before 2.4.10 allows remote attackers to cause a denia
The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2
Oracle HTTP Server and WebLogic Server Proxy Plug-in have a CVSS 10.0 access control vulnerability allowing unauthentica
Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directiv
mod_session_dbd.c in the mod_session_dbd module in the Apache HTTP Server before 2.4.5 proceeds with save operations for
The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from t
The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which al
Exploit-DB