What is the CVSS score of CVE-2026-60438?

CVE-2026-60438 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle HTTP Server are affected by CVE-2026-60438?

Oracle HTTP Server versions 12.2.1.4.0 and 14.1.2.0.0 contain a critical authentication bypass vulnerability in the mod_ssl module that allows unauthenticated remote attackers to read, modify, or…

How to fix or mitigate CVE-2026-60438?

Within 24 hours, identify and inventory all systems running Oracle HTTP Server 12.2.1.4.0 or 14.1.2.0.0, prioritizing internet-facing and externally accessible instances, and determine which systems process or store sensitive data. Within 7 days, implement network-level mitigations by restricting HTTP and HTTPS access to these servers to authorized internal networks and trusted IP addresses only, deploy WAF rules to detect suspicious mod_ssl module requests if available, and disable the mod_ssl module entirely if SSL/TLS termination is not operationally required at the HTTP Server layer. Within 30 days, establish a patch-readiness plan with Oracle support, monitor Oracle Security Alerts and CISA advisories weekly for patch release, and develop and test a rapid deployment procedure to apply vendor fixes across all affected systems immediately upon availability.

Oracle HTTP Server CVE-2026-60438

EUVD-2026-46835 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-67jp-m3r7-6hq2

Authentication Bypass Oracle Http Server

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Network-reachable HTTP/mod_ssl auth bypass needs no credentials or interaction (AV:N/AC:L/PR:N/UI:N); full read/write to data gives C:H/I:H, no service disruption so A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:49 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_ssl). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server accessible data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthenticated compromise of Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0 (a Fusion Middleware component) is possible over the network via HTTP against the mod_ssl module, letting a remote attacker read, create, delete or modify all server-accessible data. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact but no availability impact, and tagged as an authentication bypass. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitability (AV:N/AC:L/PR:N/UI:N) makes it a high-priority patch.

Technical ContextAI

Oracle HTTP Server (OHS) is Oracle's web tier built on the Apache HTTP Server codebase and shipped as part of Oracle Fusion Middleware, commonly fronting WebLogic and other middleware deployments. The affected component is mod_ssl, the module responsible for terminating TLS/SSL connections and, in some deployments, performing client-certificate based authentication and access control. The 'Authentication Bypass' tag combined with mod_ssl as the flaw location points to a weakness in how TLS/SSL identity or access enforcement is handled, allowing a request to be treated as authorized without valid credentials. No CWE was assigned in the source data, so the precise root-cause class (e.g., improper authentication or improper access control) cannot be confirmed from the input.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update per the advisory at https://www.oracle.com/security-alerts/cpujul2026.html, which is the primary and vendor-authoritative remediation for both affected releases (12.2.1.4.0 and 14.1.2.0.0); an exact fixed build number was not included in the input, so identify the specific CPU patch for your OHS version from that advisory. Patch available per vendor advisory. As interim compensating controls until patching, restrict network reachability of the OHS HTTPS listeners to trusted networks via firewall or ACLs, place the server behind a hardened reverse proxy or WAF that enforces authentication independently, and if client-certificate or mod_ssl-based access enforcement is used, audit and tighten those rules - noting that restricting listener exposure may break legitimate external clients and that a fronting proxy adds operational complexity and a new trust boundary. Because the flaw is an authentication bypass, do not rely on mod_ssl's own access controls as the mitigation.