CVE-2026-87347 Oracle Corporation CVE debrief

Who should care

Defenders responsible for Oracle HTTP Server instances, especially those exposed to the internet or untrusted networks, should prioritize patching and verify data integrity. This includes IT security teams, system administrators, and operators managing Oracle Fusion Middleware deployments. Vulnerability management and platform security teams should also be aware of the potential impacts and coordinate on remediation efforts.

Why it matters

CVE-2026-87347 is a critical vulnerability in Oracle HTTP Server that allows low-privileged attackers to compromise servers and access critical data. Defenders should prioritize patching affected versions, restrict network access, and verify data integrity.

• Potential unauthorized creation, deletion, or modification of critical data
• Potential unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data
• Need for immediate patching of affected Oracle HTTP Server versions
• Verification of data integrity and access controls

Technical summary

The vulnerability in Oracle HTTP Server (component: OSSL Module) allows low-privileged attackers with network access via HTTP to compromise the server. Successful attacks can result in unauthorized creation, deletion, or modification access to critical data or all Oracle HTTP Server accessible data, as well as unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. The CVSS 3.1 Base Score is 9.6, indicating critical severity.

Defensive priority

Defenders should prioritize patching Oracle HTTP Server instances, especially those exposed to the internet or untrusted networks, and verify the integrity of critical data.

Recommended defensive actions

• Apply patches for Oracle HTTP Server versions 12.2.1.4.0 and 14.1.2.0.0
• Restrict network access to Oracle HTTP Server instances
• Monitor Oracle HTTP Server logs for suspicious activity
• Verify data integrity and access controls
• Conduct vulnerability scanning to identify exposed instances
• Implement compensating controls for exposed systems
• Review and update asset inventory for Oracle HTTP Server deployments

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impacts, and affected versions. Oracle's security alert (CPUOct2026) is referenced but not examined. Defenders should verify data integrity and access controls, considering potential scope changes and impacts on additional products. Evidence from Oracle and NIST supports the critical severity and potential for unauthorized data access or modification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.