Oracle HTTP Server EUVD-2026-106388

Exploitation requires network reachability to the Oracle HTTP Server over HTTP and a valid low-privileged account (PR:L) - it is NOT unauthenticated. The vulnerable code path is in the OSSL Module of Oracle HTTP Server, affecting Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 specifically. No user interaction is required (UI:N) and complexity is low (AC:L). The scope change (S:C) means a successful attack can reach beyond OHS into additional connected Oracle products, so OHS instances acting as a front end or proxy to other Fusion Middleware services face amplified impact. Limiting factors: the attacker must first hold low-privileged credentials, the HTTP listener and OSSL Module must be reachable, and only the two named versions are in scope.

This is a genuinely high-priority flaw, not a high-CVSS-but-low-real-risk artifact. The CVSS 3.1 base score of 9.6 is driven by a strong, internally consistent vector: network attack vector (AV:N over HTTP), low attack complexity (AC:L), only low privileges required (PR:L), no user interaction (UI:N), a scope change (S:C) that extends impact to additional products, and high confidentiality and integrity impact (C:H/I:H) with no availability impact (A:N). The scope change is the key risk amplifier - a compromise of the OSSL Module in Oracle HTTP Server can cascade into other Fusion Middleware components. However, several exploitation signals are MISSING from the provided data: there is no EPSS exploitation-probability score, no CISA KEV listing, and no POC indicator, so exploitation likelihood cannot be quantified - no public exploit identified at time of analysis. One conflict to verify: the input Tags label this 'Authentication Bypass', yet the CVSS vector specifies PR:L (low privileges required), which contradicts a true unauthenticated authentication bypass - the attacker must already hold a low-privileged account, so the 'Authentication Bypass' tag appears inaccurate and should be verified against the Oracle advisory. Net: treat as a priority patch for Oracle-middleware environments given the 9.6 score and scope change, while recognizing that real-world exploitation volume is currently unmeasurable from the available signals.

A low-privileged authenticated user (or an attacker who has obtained low-level credentials) sends crafted HTTP traffic to the OSSL Module of an exposed Oracle HTTP Server instance. Because the flaw is easily exploitable (AC:L) and produces a scope change, the attacker reads or alters critical data not only within OHS but across additional connected Oracle products. No public exploit code is identified at time of analysis, and no user interaction is required.