CVE-2026-87359
HighCVSS 8.8Summary
Vulnerability in Oracle Service Bus (component Core), affecting versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can easily take over the product.
Risk Assessment
Could lead to takeover of Oracle Service Bus, impacting confidentiality, integrity and availability. The CVSS score of 8.8 indicates serious risk.
Recommendation
Apply the Oracle patch for versions 12.2.1.4.0 and 14.1.2.0.0 and restrict privileges of accounts accessing the service.
Other vulnerabilities in Oracle Service Bus
See all- CVE-2026-87420High
Vulnerability in Oracle Service Bus (Core component) affecting version 14.1.2.0.0. An easily exploitable flaw allows a low-privileged attacker with HTTP network access to take over Oracle Service Bus.
- CVE-2026-87419High
Vulnerability in Oracle Service Bus (Core component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An easily exploitable flaw allows a low-privileged attacker with HTTP network access to take over Oracle Service Bus.
- CVE-2026-87369High
Vulnerability in Oracle Service Bus (component Core), affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can easily cause a hang or repeatable crash (complete DoS) of the product.
- CVE-2026-87364High
Vulnerability in Oracle Service Bus (component Core), affecting versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can easily take over the product.
Original NVD description (English source)
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus. Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS