EUVD-2026-106405
GHSA-wvwg-jh57-xfjc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged Service Bus account
-
ExploitReach Core component over HTTP
-
ExecutionExploit vulnerability in request handling
-
ImpactEscalate to full Service Bus takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the Oracle Service Bus Core component over HTTP and a valid low-privileged account on the target (CVSS PR:L) - it is NOT unauthenticated. No user interaction is required (UI:N) and attack complexity is low (AC:L). Affected deployments are limited to Oracle Service Bus versions 12.2.1.4.0 and 14.1.2.0.0; other versions are not listed as affected. The primary limiting factor is the credential requirement: an attacker must first obtain or be granted a low-privilege account, so instances that restrict account provisioning and network exposure of the HTTP interface materially reduce realistic risk. |
| Impact | This is a credible high-priority patch target, though not an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) is internally consistent with the description: network-reachable over HTTP, low attack complexity, no user interaction, and full compromise of confidentiality, integrity, and availability ('takeover'). The one gating factor is PR:L - a low-privileged but authenticated account is required, so this is not fully unauthenticated. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is NO evidence of active exploitation or weaponization at time of analysis; the urgency here is driven by severity and the historical tendency for Oracle Fusion Middleware admin-interface flaws to be reverse-engineered from quarterly CPU patches, not by observed exploitation. Note a signal conflict worth flagging: the sole impact-related tag is 'Information Disclosure,' which understates a vulnerability the description explicitly characterizes as full takeover with High integrity and availability impact - do not treat this as a read-only disclosure bug. Net: prioritize patching for internet- or partner-facing Service Bus instances where low-privileged accounts exist, but absent KEV/EPSS/POC this is a 'patch in the normal CPU cycle, expedited for exposed instances' rather than a confirmed in-the-wild threat. |
| Exploit ScenarioDerived | An attacker who already holds a low-privileged account on an Oracle Service Bus instance (12.2.1.4.0 or 14.1.2.0.0) sends a crafted HTTP request to the Core component and leverages the flaw to gain full control of the Service Bus, reading or tampering with integration messages and service configurations. Because attack complexity is low and no user interaction is needed, exploitation is reliable once network access and credentials are obtained. No public exploit code was identified in the provided data, so this scenario is inferred from the CVSS vector rather than a demonstrated exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0 expose a high-severity flaw in the Core component that lets a low-privileged, network-positioned attacker take over the service bus, with full impact to confidentiality, integrity and availability (CVSS 3.1 base 8.8). Exploitation is straightforward once credentials exist - no user interaction, low attack complexity, HTTP-reachable - but it is not unauthenticated: the attacker must already hold a valid low-privilege account on the target (PR:L). At time of analysis there is no CISA KEV listing and no public exploit code identified, so this is a credible high-priority patch target rather than an emergency, and the practical risk is dominated by how freely low-privilege accounts can be obtained and how exposed the HTTP interface is.
RemediationAI
Oracle addresses this in the October 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuoct2026.html); apply the CPU-specified patch set for Service Bus 12.2.1.4.0 and 14.1.2.0.0 - patch available per vendor advisory, with the exact bundle/version to be taken from that advisory rather than inferred. Until patched, reduce the credential prerequisite that gates exploitation: audit and prune low-privileged Service Bus accounts, enforce strong authentication and just-in-time provisioning so an attacker cannot cheaply obtain the PR:L foothold, with the trade-off of added operational friction for integration and operations users. Restrict network reachability of the Service Bus Core HTTP endpoints to known consumer networks via firewall rules, reverse-proxy ACLs or a WAF, accepting that this complicates legitimate cross-segment service calls. Rotate credentials and certificates stored in the Service Bus configuration if compromise is suspected, and alert on anomalous administrative or configuration changes in service-bus logs, since those are the observable precursors to a full takeover. No public exploit code was identified at time of analysis, so prioritise patching by exposure rather than by emergency response.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Service Bus is the Java-based enterprise service bus inside Oracle Fusion Middleware, used to mediate, route and transform service traffic between back-end systems; the affected 'Core' component handles the runtime plumbing that underpins message flow and administrative operations exposed over HTTP. No CWE identifier was assigned in the available data, so the precise defect class is not formally characterised, but the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a low-complexity, network-reachable weakness that a merely low-privileged authenticated user can drive past its intended authorization boundary to gain complete control of the service bus - an unchanged scope (S:U) means the compromise stays within the Service Bus security authority while affecting all three CIA pillars. Because the bus is a trust broker that holds credentials and routing configuration for downstream services, a takeover has a naturally lateral blast radius even though the CVSS scope is unchanged. EUVD records the affected product set as Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0 only.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description states network HTTP access by a low-privileged attacker with no user interaction, yielding takeover, so AV:N/AC:L/PR:L/UI:N with full C/I/A impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus. Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0 contain a high-severity flaw in the Core component that lets an authenticated low-privilege user seize full control of the integration platform, putting every message, credential and transaction it brokers at risk of disclosure, tampering or outage. Because the service bus typically sits between internal systems and partner-facing services, a compromise provides a foothold with reach into downstream applications and could disrupt revenue-supporting integrations. Leadership should focus less on the technical difficulty of exploitation and more on how freely low-privilege accounts are provisioned and how widely the HTTP interface is exposed, particularly as no vendor patch is currently available.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network reachability of the Core HTTP interface to trusted hosts and management networks, aggressively minimize and monitor low-privilege accounts (least privilege, disable stale or shared credentials, enforce MFA), segment the service bus from downstream systems, and alert on anomalous administrative or privilege-escalation activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB