Oracle HTTP Server CVE-2026-60530

Exploitation requires the attacker to already have interactive logon access with low privileges (PR:L) to the infrastructure where Oracle HTTP Server executes - this is a local vector (AV:L), not remotely reachable over the network, which is the primary limiting factor. The vulnerable code is in the mod_http2.so HTTP/2 module, so an OHS deployment with that module loaded (the default) is the affected surface. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning once local access is obtained exploitation is straightforward. The specific configuration trigger beyond 'OHS 14.1.2.0.0 with mod_http2 present' is not disclosed in Oracle's summary. Defenders should note that anything restricting local logon on the middleware host directly reduces exploitability.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 High) indicates an attacker must already have local logon access to the OHS host and low privileges, but then needs no user interaction and gains full compromise of the server. This is a meaningful privilege-escalation/takeover risk in shared or multi-tenant hosting contexts, but the local-only vector materially limits blast radius compared with a network-reachable HTTP/2 flaw. There is no CISA KEV listing and no public exploit identified, so this is not confirmed actively exploited; EPSS and SSVC data were not provided in the input and cannot be cited. Overall this is a genuine High-severity issue to patch in the normal Oracle CPU cycle rather than an emergency, since the local-access prerequisite raises the bar for opportunistic attackers. Note the tag 'Information Disclosure' in the intelligence feed is narrower than the vector's C:H/I:H/A:H full-takeover impact - treat the CVSS impact as authoritative and the tag as an incomplete label.

An attacker who already holds a low-privileged local account on the server hosting Oracle HTTP Server - for example a limited operational or developer login on a shared middleware tier - interacts with the vulnerable mod_http2.so code path to escalate to full control of the OHS instance, gaining read/write over its data and the ability to disrupt service. No user interaction or elevated privileges are needed beyond the initial logon. No public proof-of-concept is available at the time of analysis.