CVE-2026-87369 Oracle Corporation CVE debrief

Who should care

Oracle Service Bus administrators, security teams responsible for Oracle Fusion Middleware, and IT personnel managing critical infrastructure should assess exposure and apply patches.

Why it matters

CVE-2026-87369 is a high-severity vulnerability in Oracle Service Bus that allows unauthenticated attackers to cause a denial of service (DOS). Oracle Service Bus administrators and security teams should assess exposure, apply patches, and monitor for potential exploitation attempts.

• Potential denial of service (DOS) impacting availability
• Requires verification of affected versions and exposure
• Necessitates patching or compensating controls for Oracle Service Bus
• May require monitoring for exploitation attempts

Technical summary

CVE-2026-87369 is a high-severity vulnerability in Oracle Service Bus, allowing unauthenticated attackers with network access via HTTP to compromise Oracle Service Bus, potentially causing a hang or frequently repeatable crash (complete DOS). The vulnerability has a CVSS score of 7.5 and affects versions 12.2.1.4.0 and 14.1.2.0.0. It is essential to identify affected product deployments in managed environments, review and apply Oracle patches, and monitor for potential exploitation attempts. The vulnerability can be mitigated by verifying network access controls to restrict HTTP access to Oracle Service Bus.

Defensive priority

High priority for Oracle Service Bus administrators to assess exposure and apply patches

Recommended defensive actions

• Assess exposure of Oracle Service Bus instances, particularly versions 12.2.1.4.0 and 14.1.2.0.0
• Review and apply Oracle patches for this vulnerability
• Monitor Oracle Service Bus logs for potential exploitation attempts
• Verify network access controls to restrict HTTP access to Oracle Service Bus
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and Oracle advisory provide details on the vulnerability, affected versions, and potential impact. However, additional information on exploitation or victim organizations is not available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.