Oracle HTTP Server EUVD-2026-106718

Requires an authenticated low-privilege local logon (PR:L) to the infrastructure/host where Oracle HTTP Server 12.2.1.4.0 executes; the flaw resides in the Web Listener component. It is NOT remotely exploitable (AV:L) despite OHS being a web server, and no user interaction is needed (UI:N). The primary limiting factor is the prerequisite of existing local access to the server, which confines realistic exploitation to insiders or attackers who have already achieved an initial foothold; only version 12.2.1.4.0 is stated as affected.

This is a genuine but access-constrained risk. The CVSS 3.1 base score of 7.8 (High) is driven entirely by local vectoring (AV:L) combined with low attack complexity (AC:L), low privileges (PR:L), no user interaction (UI:N), and full High impact to confidentiality, integrity, and availability (C:H/I:H/A:H) with unchanged scope (S:U). Critically, despite Oracle HTTP Server being a network-facing web server, this vulnerability is NOT remotely exploitable - the attacker must already have an authenticated low-privilege logon to the host where OHS executes, which sharply narrows the realistic threat population to insiders, compromised service accounts, or attackers who have already gained an initial foothold via another vector. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input, so exploitation probability cannot be quantified from signals - there is no evidence of active exploitation or public exploit code. The signals are internally consistent (local privilege-escalation-style takeover), so there is no CVSS-versus-description conflict to flag. Bottom line: a legitimate High-severity local privilege/host-takeover issue that should be patched in Oracle's October 2026 CPU cycle, but it is a second-stage/insider risk rather than an internet-exposed emergency.

An attacker who already holds a low-privilege local account on the server hosting Oracle HTTP Server (for example, a compromised application or service account) exploits a flaw in the Web Listener component to take over the OHS instance. Because attack complexity is low and no user interaction is required, the escalation to full compromise of the HTTP Server is reliable once local access is obtained. No public exploit code was identified in the provided intelligence.