What is the CVSS score of CVE-2026-60530?

CVE-2026-60530 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Oracle HTTP Server are affected by CVE-2026-60530?

Oracle HTTP Server 14.1.2.0.0 is vulnerable to local privilege escalation through its HTTP/2 module, enabling users with host access to gain complete control of the web server and all hosted…

How to fix or mitigate CVE-2026-60530?

Within 24 hours, identify all systems running Oracle HTTP Server 14.1.2.0.0 and review system access logs for suspicious local user activity and privilege escalation attempts. Within 7 days, apply Oracle's July 2026 Critical Patch Update to all affected instances and validate successful deployment; during this window, restrict local user access and disable unnecessary logon accounts where operationally feasible. Within 30 days, conduct a security audit to confirm no unauthorized privilege escalation occurred and establish ongoing controls for local access management and monitoring.

Oracle HTTP Server CVE-2026-60530

EUVD-2026-46892 HIGH

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-376c-84pj-3hj8

Oracle Privilege Escalation Http Server

7.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Requires low-privileged local logon to the OHS host (AV:L/PR:L), no user interaction, and yields full server takeover, so C/I/A all High.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:52 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 7.8

DescriptionCVE.org

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_http2.so). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HTTP Server executes to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Local privilege-driven takeover in Oracle HTTP Server 14.1.2.0.0 (Oracle Fusion Middleware) lets a low-privileged attacker with logon access to the host running OHS fully compromise the server via the bundled HTTP/2 module (mod_http2.so). With a CVSS 3.1 base score of 7.8 and full confidentiality, integrity, and availability impact, successful exploitation yields complete takeover of the OHS instance. Fixed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis.

Technical ContextAI

The affected component is mod_http2.so, the Apache-derived HTTP/2 protocol module shipped with Oracle HTTP Server, the web-tier component of Oracle Fusion Middleware 14.1.2.0.0. mod_http2 implements the HTTP/2 multiplexed binary framing layer (RFC 7540) on top of Apache httpd, handling stream management, header (HPACK) processing, and flow control - historically a source of memory-safety and resource-handling defects. Oracle publishes CWE as N/A for this entry, so the exact root-cause class is not disclosed; the local attack vector (AV:L) combined with full CIA impact suggests a flaw exploitable by a logged-in user against the OHS process (for example via memory corruption, insecure file/permission handling, or process interaction) rather than a purely remote HTTP/2 parsing bug.

RemediationAI

Apply the fixes in Oracle's July 2026 Critical Patch Update, published at https://www.oracle.com/security-alerts/cpujul2026.html - Patch available per vendor advisory; the input does not include a discrete fixed version string, so validate the exact patch/bundle number for Oracle HTTP Server 14.1.2.0.0 directly in the CPU matrix. As interim compensating controls, tighten OS-level access to the OHS host so that only trusted administrators hold local logon rights (the vulnerability requires PR:L local access), enforce least-privilege on the account running the OHS process, and audit shell/interactive access on middleware tiers; if HTTP/2 is not required for your workloads, consider disabling the mod_http2 module in httpd.conf to remove the vulnerable code path, accepting the trade-off that clients fall back to HTTP/1.1 with reduced multiplexing performance. Because the CVE reference (https://nvd.nist.gov/vuln/detail/CVE-2026-60530) may lag, rely on the Oracle CPU page for authoritative patch identifiers.