CVE-2026-87364 Oracle Corporation CVE debrief

Who should care

Defenders responsible for Oracle Service Bus instances, especially those exposed to the internet or untrusted networks, should assess exposure and prioritize remediation. IT teams and security professionals managing Oracle Fusion Middleware should verify affected versions and apply patches or mitigations as recommended by Oracle.

Why it matters

CVE-2026-87364 is a high-severity vulnerability in Oracle Service Bus that allows low-privileged attackers to compromise the system. Defenders should assess exposure, prioritize remediation, and verify affected versions to mitigate potential risks.

• Potential system compromise and takeover by low-privileged attackers.
• Exposure to HTTP-based attacks, especially for internet-facing instances.
• Need for prompt remediation to prevent potential attacks.
• Verification of affected versions and patch application to mitigate risk.

Technical summary

The CVE-2026-87364 vulnerability affects Oracle Service Bus, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It allows low-privileged attackers with network access via HTTP to compromise the system, potentially leading to takeover. The CVSS score for this vulnerability is 8.8, indicating a high severity level. The vulnerability is easily exploitable and can result in takeover of Oracle Service Bus. Defenders should review the official advisory, assess exposure, and apply patches or mitigations as recommended by Oracle.

Defensive priority

High priority remediation recommended for Oracle Service Bus instances, especially those exposed to the internet or untrusted networks.

Recommended defensive actions

• Assess exposure of Oracle Service Bus instances, especially those with internet exposure or on untrusted networks.
• Prioritize remediation based on business criticality and potential impact.
• Verify affected versions and apply patches or mitigations as recommended by Oracle.
• Monitor for potential attacks or suspicious activity on Oracle Service Bus instances.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its CVSS score, and potential impacts. Oracle has released a security alert addressing this issue. The vulnerability allows low-privileged attackers with network access via HTTP to compromise Oracle Service Bus, potentially leading to takeover. Defenders should verify affected versions, assess exposure, and apply patches or mitigations as recommended by Oracle. The CVE record was published on 2026-10-20T22:20:14.370Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.