Oracle Service Bus CVE-2026-87359

Requires a valid low-privileged account on the target Oracle Service Bus instance (PR:L) and network reachability to its HTTP interface; exploitation then works against supported versions 12.2.1.4.0 and 14.1.2.0.0 with no user interaction and low attack complexity. The limiting factors are the need for authenticated low-privileged credentials and network/HTTP access to the Service Bus management or messaging endpoint - exposure is reduced where Service Bus HTTP interfaces are segmented from untrusted networks and credential issuance is tightly controlled. No non-default feature toggle is named in the description, so default supported configurations appear affected.

This is a genuine high-priority vulnerability, not an inflated score. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8) indicates a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with full confidentiality, integrity, and availability impact - the description's language 'takeover of Oracle Service Bus' is consistent with the C:H/I:H/A:H rating. The one meaningful barrier is PR:L: an attacker needs valid low-privileged credentials, which moderates mass-exploitation potential compared with a PR:N flaw. No EPSS score was provided, so exploitation probability cannot be quantified from this input. The vulnerability is NOT in CISA KEV and no public exploit code was referenced, so this is currently no public exploit identified at time of analysis - treat as a high-severity patch priority rather than confirmed active exploitation. One data inconsistency to flag: the input Tags include 'Information Disclosure,' but the CVSS vector and description describe full system takeover (C:H/I:H/A:H), so the tag understates the actual impact - do not deprioritize based on that tag.

An attacker who already holds a low-privileged account on an internet- or intranet-reachable Oracle Service Bus instance sends crafted HTTP requests to the Core component. Because attack complexity is low and no user interaction is needed, the request chain leads to full compromise of the Service Bus, giving the attacker control over message flows, credentials, and backend integrations. No public proof-of-concept was referenced in the provided intelligence.