EUVD-2026-106458
GHSA-r25f-8m5q-7w4w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege account on Service Bus
-
ExploitSend crafted HTTP request to Core component
-
ExecutionExploit flaw to escalate
-
ImpactAchieve full Service Bus takeover
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privilege authenticated account on the Oracle Service Bus (PR:L) with network HTTP access to the Core component; no user interaction and no non-default configuration are stated as prerequisites, so default deployments of the affected versions (12.2.1.4.0 and 14.1.2.0.0) are exposed to any authenticated user. The principal limiting factor is the authentication requirement - fully unauthenticated attackers cannot exploit this directly - which reduces exposure for instances with tightly controlled, minimal account provisioning and no network-facing management interface. |
| Impact | This is a genuinely high-priority vulnerability. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with full compromise of confidentiality, integrity, and availability - the description explicitly states the outcome is 'takeover of Oracle Service Bus.' The one tension in the data is that the only impact tag is 'Information Disclosure,' which understates the actual C:H/I:H/A:H takeover impact; the CVSS vector and 'takeover' language should be treated as authoritative over that tag. Tempering the raw score: no EPSS probability is provided, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced, so this is a high-severity but not yet demonstrably-exploited issue. The PR:L requirement also means an attacker needs a valid low-privilege account, which narrows opportunistic mass exploitation versus a fully unauthenticated flaw. Net: prioritize patching from the October 2026 Oracle CPU, but current evidence points to potential rather than confirmed active exploitation. |
| Exploit ScenarioDerived | An attacker who holds any low-privilege authenticated account on an Oracle Service Bus instance (12.2.1.4.0 or 14.1.2.0.0) sends crafted HTTP requests to the Core component over the network. Because attack complexity is low and no user interaction is needed, the attacker escalates to full control, achieving complete compromise ('takeover') of the Service Bus. No public exploit code is identified at time of analysis, so exploitation would currently require independent development. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Low-privileged authenticated attackers with network HTTP access can exploit the Oracle Service Bus Core component to achieve takeover of the service, with high confidentiality, integrity, and availability impact (CVSS 8.8). Oracle Service Bus 12.2.1.4.0 and 14.1.2.0.0 are affected, and exploitation requires a valid account but no user interaction; no public exploit code was identified at time of analysis. The authentication prerequisite limits exposure compared with unauthenticated flaws, but default deployments reachable over HTTP remain at risk from any low-privilege user.
RemediationAI
Apply the Oracle Service Bus fix from the Oracle Critical Patch Update advisory for October 2026 (https://www.oracle.com/security-alerts/cpuoct2026.html); the exact patched build number is not specified in the provided data, so confirm the applicable patch for 12.2.1.4.0 and 14.1.2.0.0 in the advisory. Until patched, reduce exposure by restricting HTTP access to Service Bus Core endpoints to trusted networks and removing or tightly limiting low-privilege accounts, accepting that this may disrupt legitimate integrations and administrative workflows. Monitor Service Bus and web-server logs for anomalous authenticated HTTP activity; if external access to the Core interface is not required, disabling or firewalling it provides a practical compensating control at the cost of reduced remote administration.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Service Bus is part of Oracle Fusion Middleware and provides service integration, routing, and mediation capabilities. The flaw is in the Core component and is reachable over HTTP by an authenticated low-privilege user. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates that an attacker needs a valid account but no user interaction, and successful exploitation affects only the Service Bus scope while fully compromising confidentiality, integrity, and availability. No CWE is assigned in the source data, so the precise implementation flaw, such as an authorization bypass or unsafe input handling, cannot be determined from this record. The EUVD entry confirms affected versions 12.2.1.4.0 and 14.1.2.0.0, and no CPE identifiers were supplied for exact platform matching.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP reachable (AV:N), low complexity (AC:L), requires a low-privilege account (PR:L), no interaction (UI:N), and description confirms full takeover (C:H/I:H/A:H).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus. Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Service Bus versions 12.2.1.4.0 and 14.1.2.0.0 contain a high-severity flaw that allows any low-privileged account to take over the service, exposing sensitive integration data and disrupting availability. Because this middleware often bridges internal systems, a compromise could give attackers a foothold for lateral movement across the enterprise. Leadership should prioritize containment given the absence of a vendor patch and the broad reach of default HTTP deployments.
No vendor patch is available; restrict HTTP access to affected endpoints, enforce least privilege and disable unnecessary accounts, segment Service Bus deployments, and monitor for anomalous administrative activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB