Oracle HTTP Server CVE-2026-91419

Exploitation requires the attacker to already have an authenticated low-privilege logon (PR:L) to the operating system/infrastructure on which Oracle HTTP Server 12.2.1.4.0 executes - specifically interacting with the OSSL module. This is NOT remotely exploitable by an unauthenticated attacker: the AV:L vector and Oracle's 'logon to the infrastructure where Oracle HTTP Server executes' wording mean a local account on the host is a hard prerequisite, which is the primary factor limiting real-world risk. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once local access exists the exploit is straightforward; exposure is further limited to the single affected supported version (12.2.1.4.0).

This is a locally-exploitable flaw: the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) and Oracle's own description agree that the attacker needs a logon to the infrastructure where Oracle HTTP Server runs (PR:L, authenticated low-privilege) and no user interaction, with full confidentiality, integrity and availability impact resulting in complete takeover of the HTTP Server. All signals are internally consistent - there is no network-vs-local contradiction here (AV:L matches the 'logon to the infrastructure' wording). However, the real-world prioritization signals are thin: there is no EPSS score, no CISA KEV listing, and no public POC in the provided data, which places this below internet-facing unauthenticated flaws in urgency. The practical risk is that of a local privilege-escalation / host-compromise primitive - dangerous for multi-tenant or shared middleware hosts and useful as a second-stage escalation after an initial foothold, but it cannot be triggered remotely by an unauthenticated attacker. One data conflict worth noting: the input Tags label this 'Information Disclosure,' yet the description and CVSS indicate full takeover (C:H/I:H/A:H), so treating it as mere info disclosure would understate its impact - verify against the Oracle CPU advisory.

An attacker who already holds a low-privilege local account on the server hosting Oracle HTTP Server 12.2.1.4.0 abuses a flaw in the OSSL module to compromise the HTTP Server process and fully take it over. No user interaction or additional privileges are needed beyond the initial logon, making this a reliable local escalation once any foothold exists. No public exploit code was identified at time of analysis.