Oracle HTTP Server EUVD-2026-106387

Requires the Oracle WebLogic Server Proxy Plug-in for Oracle HTTP Server to be deployed and reachable over HTTP, affecting Oracle HTTP Server versions 12.2.1.4.0 and 14.1.2.0.0; no authentication or user interaction is needed (PR:N/UI:N). The principal limiting factor is the 'Difficult to exploit' rating (AC:H): the attacker must meet conditions outside their control - plausibly specific proxy/request timing or configuration states - so exploitation is not reliably repeatable against arbitrary targets. The scope change (S:C) means a successful attack can impact products beyond the HTTP Server itself, so the realistic blast radius depends on what back-end systems the plug-in fronts.

This is a genuinely serious but not panic-grade vulnerability. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N, base 8.7) shows a network-reachable, unauthenticated (PR:N) flaw with no user interaction, high confidentiality and integrity impact, and a scope change that can spill into other products - all factors that raise priority. The critical mitigating signal is AC:H ('Difficult to exploit' per Oracle), meaning successful exploitation depends on conditions outside the attacker's control (e.g., timing, specific proxy configuration, or race-like preconditions), which materially lowers the odds of reliable mass exploitation. No EPSS score, KEV listing, or POC indicator is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the only source is Oracle's own October 2026 Critical Patch Update. Net: treat as a high-priority patch for any Oracle HTTP Server fronting WebLogic, but the high attack complexity and absence of any exploitation signal suggest this is not (yet) a widespread, automatable threat. Conflicting signal to flag: the 'Authentication Bypass' tag is not supported by the description, which describes a data confidentiality/integrity compromise with scope change rather than an auth-bypass primitive - verify the vulnerability class against Oracle's advisory.

A remote, unauthenticated attacker sends specially crafted HTTP traffic to an internet-facing or internal Oracle HTTP Server running the WebLogic proxy plug-in, exploiting a flaw in how the plug-in handles proxied requests to read or tamper with sensitive data. Because exploitation is rated 'difficult' (AC:H), the attacker likely must satisfy specific timing or configuration preconditions to succeed. No public exploit identified at time of analysis, so any current attempts would require original exploit development.