CVE-2026-87346 Oracle Corporation CVE debrief

Who should care

Defenders responsible for Oracle HTTP Server deployments, particularly those using versions 12.2.1.4.0 or 14.1.2.0.0, should assess their exposure and prioritize patching to prevent potential data integrity and confidentiality impacts.

Why it matters

CVE-2026-87346 is a high-severity vulnerability in Oracle HTTP Server that allows unauthenticated attackers to potentially compromise the server and access critical data. Defenders should prioritize verifying exposure, assessing data access impacts, and applying vendor-provided patches to prevent potential data integrity and confidentiality impacts.

• Potential unauthorized creation, deletion, or modification of critical data
• Potential unauthorized access to critical or all Oracle HTTP Server accessible data
• Need for verification of exposure and impact on data access
• Priority for applying patches to prevent exploitation

Technical summary

The vulnerability, CVE-2026-87346, is in the Oracle Weblogic Server Proxy Plug-in for Oracle HTTP Server, part of Oracle Fusion Middleware. It has a CVSS 3.1 Base Score of 8.7, indicating high severity. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server, potentially leading to unauthorized creation, deletion, or modification of critical data, as well as unauthorized access to critical or all Oracle HTTP Server accessible data.

Defensive priority

Defenders should prioritize verifying exposure, assessing the impact of potential unauthorized data access, and applying vendor-provided patches.

Recommended defensive actions

• Verify exposure by checking if Oracle HTTP Server versions 12.2.1.4.0 or 14.1.2.0.0 are in use
• Assess potential impact on data access and integrity
• Apply patches provided by Oracle Corporation as described in their advisory
• Monitor for unauthorized data access or modifications
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, its impacts, and affected versions. However, additional information on potential exploits or victim organizations is not available in the supplied corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.