What is the CVSS score of CVE-2026-60454?

CVE-2026-60454 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Oracle HTTP Server are affected by CVE-2026-60454?

Oracle HTTP Server (versions 12.2.1.4.0 and 14.1.2.0.0) contains a local privilege escalation vulnerability enabling complete server compromise from any low-privileged user with system access,…

How to fix or mitigate CVE-2026-60454?

Within 24 hours: conduct a complete inventory of Oracle HTTP Server instances, identifying and documenting all systems running versions 12.2.1.4.0 or 14.1.2.0.0, then immediately restrict local logon access to only essential administrative accounts. Within 7 days: deploy kernel-level audit logging and privilege-escalation monitoring on affected hosts to detect exploitation attempts, and initiate technical evaluation of whether applications can migrate to patched or alternative web server platforms. Within 30 days: establish a formal upgrade plan contingent on Oracle patch availability; conduct controlled penetration testing from low-privileged user contexts to validate compensating controls; and schedule remediation testing for the moment a vendor patch becomes available.

Oracle HTTP Server CVE-2026-60454

EUVD-2026-46849 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-6c8m-vp6x-fmhj

Oracle Privilege Escalation Http Server

7.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Requires an existing low-privileged local logon (AV:L, PR:L), needs no user interaction, and results in full server takeover, so C/I/A all High.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 04:02 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.8

DescriptionCVE.org

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HTTP Server executes to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Local privilege-based takeover of Oracle HTTP Server (12.2.1.4.0 and 14.1.2.0.0) allows a low-privileged attacker with a logon session on the host to fully compromise the web server, yielding high confidentiality, integrity, and availability impact. Disclosed in Oracle's July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 base score of 7.8 with a local attack vector (AV:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but complete server takeover makes it a meaningful lateral-movement and privilege-consolidation target once a foothold exists.

Technical ContextAI

Oracle HTTP Server (OHS) is the Apache-based web tier bundled with Oracle Fusion Middleware, used to front-end WebLogic and other middleware deployments with reverse-proxy, mod_wl, and SSL termination capabilities. The affected 'Core' component handles the base HTTP request/config processing pipeline. The CVSS vector (AV:L) indicates the weakness is reached by an actor already authenticated on the underlying infrastructure rather than over the network, consistent with a local flaw such as insecure file/config handling, unsafe directory or process permissions, or improper privilege management within the OHS runtime. No CWE was assigned in the source data, so the precise root-cause class cannot be confirmed; the 'takeover' language plus full C/I/A high impact suggests the attacker can subvert the OHS process or its configuration to run in its security context.

RemediationAI

Apply the patches from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to the affected Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0 instances; Oracle distributes fixes through the CPU rather than as an independently named point release, so consult the CPU patch matrix for the exact bundle/patch number for your platform. Because exploitation requires an existing local logon, the most effective compensating controls until patching are to tightly restrict interactive and service-account access to OHS hosts, enforce least privilege and separation on the OHS installation and configuration directories (verify the oracle/ohs runtime user cannot be leveraged by lower-privileged accounts), and monitor for unexpected local logons and OHS process/config changes - the trade-off is operational overhead but no functional impact to served applications. Avoid co-locating untrusted or multi-tenant workloads on the same host as OHS to shrink the pool of potential low-privileged attackers.