Oracle HTTP Server CVE-2026-60454

Exploitation requires the attacker to already have a low-privileged logon session on the infrastructure where Oracle HTTP Server executes (CVSS AV:L, PR:L, UI:N) - it cannot be triggered remotely or unauthenticated. The affected feature is the OHS 'Core' component in versions 12.2.1.4.0 and 14.1.2.0.0. Limiting factors that reduce realistic risk: the mandatory pre-existing local foothold, the requirement for valid (even if low) credentials/privileges on the host, and applicability only to those two specific OHS versions; no user interaction and no unusual non-default configuration is stated as required, and low attack complexity means once local access is held, exploitation is straightforward.

Signals are mixed on real-world urgency. The CVSS 3.1 score of 7.8 is driven by high impact across all three dimensions and low attack complexity, but the local attack vector (AV:L) and required low privileges (PR:L) mean an attacker must already have a logon session on the OHS host - this is not a remote, unauthenticated internet-facing flaw. No EPSS score was provided, it is not in CISA KEV, and no POC is referenced, so there is no evidence of active or automated exploitation. Note a data conflict worth verifying: the intelligence tag labels this 'Information Disclosure,' yet the CVSS vector and Oracle's own description assert full Confidentiality, Integrity, AND Availability compromise ('takeover'), so the tag understates the impact - trust the CVSS/description over the tag. Overall this is a solid patch-in-the-next-cycle issue and a strong privilege-escalation/lateral-movement primitive for an attacker who already has a low-privileged shell, rather than a drop-everything internet-facing emergency.

An attacker who has obtained a low-privileged shell on an Oracle Fusion Middleware server - for example via a compromised application account or a separate remote flaw - leverages this local weakness in Oracle HTTP Server's Core component to take over the OHS process and its security context. From there they can read protected data, alter served content or proxy configuration, and disrupt availability. No public POC is currently available, but the low attack complexity means a knowledgeable local actor could weaponize it reliably once details are understood.