Oracle Service Bus CVE-2026-87369

No special conditions beyond network reachability - remote unauthenticated exploitation over HTTP against the Core component of Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0, requiring no credentials and no user interaction (AV:N/AC:L/PR:N/UI:N). The practical limiting factor is network exposure: the attacker must be able to reach the Service Bus HTTP listener, so instances restricted to internal/segmented networks or behind a filtering proxy are materially harder to hit. Impact is confined to availability (complete DOS); there is no path to data disclosure or code execution via this flaw.

This is a genuine availability risk but not a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/A:H) is internally consistent with the description: remote, unauthenticated, low-complexity HTTP-based attack causing a complete denial of service, with no confidentiality or integrity impact. The 7.5 score is driven entirely by availability. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no evidence of active or imminent widespread exploitation; this reads as a high-CVSS issue whose real-world urgency is moderated by the absence of exploitation signals and the DoS-only (non-code-execution, non-data-loss) impact. Note the signal gap explicitly: EPSS and SSVC data are entirely missing, so automatability and observed-exploitation status cannot be assessed - prioritization should lean on the easy remote unauthenticated vector and the criticality of the specific Service Bus deployment rather than on threat-intel that was not supplied.

An attacker with network reachability to an Oracle Service Bus instance sends a specially crafted HTTP request to the exposed Core component, requiring no credentials and no user interaction. The request triggers a hang or repeatable crash, taking the integration bus offline and disrupting all dependent services. No public exploit code was identified in the provided data.