Oracle Service Bus CVE-2026-87420

Exploitation requires network access to the Oracle Service Bus HTTP interface and a low-privileged authenticated account (CVSS PR:L), but no user interaction and no non-default configuration are indicated - Oracle describes it as 'easily exploitable' against the supported version 14.1.2.0.0 of the Core component. The key limiting factor is the authentication requirement: an attacker must possess at least minimal valid credentials to the Service Bus instance, so environments that restrict account provisioning and do not expose the Service Bus management/runtime HTTP endpoints to untrusted networks materially reduce realistic risk. Only version 14.1.2.0.0 is listed as affected; other versions are not stated to be vulnerable in the provided data.

This is a genuine high-priority vulnerability, not a high-CVSS-but-low-risk paper tiger. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes an easily exploitable, network-reachable flaw over HTTP requiring only low privileges and no user interaction, yielding full confidentiality, integrity, and availability loss - Oracle's own description characterizes the outcome as complete 'takeover' of Oracle Service Bus. Oracle does not publish EPSS or SSVC decision data in this feed, and no EPSS probability, KEV listing, or POC is present in the provided intelligence, so exploitation likelihood signals are entirely absent rather than low. The exploitation status is therefore 'no public exploit identified at time of analysis' - but the combination of low attack complexity, low privilege requirement, and total impact means this should be patched urgently regardless of the missing probabilistic signals, as Oracle middleware CPU fixes are routinely reverse-engineered after release. Note one data tension: the input Tags label this 'Information Disclosure,' which conflicts with the full C:H/I:H/A:H takeover described - the tag understates the true impact.

A low-privileged user who already holds valid (even minimal) credentials to the Oracle Service Bus environment sends a crafted HTTP request to the exposed Service Bus interface and exploits a flaw in the Core component to escalate to full control of the product. Because attack complexity is low and no user interaction is required, a single authenticated attacker - or an attacker who has phished/obtained any low-tier account - can reliably achieve takeover. No public proof-of-concept is identified in the provided data at the time of analysis.