CVE-2026-87420
HighCVSS 8.8Summary
Vulnerability in Oracle Service Bus (Core component) affecting version 14.1.2.0.0. An easily exploitable flaw allows a low-privileged attacker with HTTP network access to take over Oracle Service Bus.
Risk Assessment
An attacker could take over Oracle Service Bus, compromising confidentiality, integrity, and availability of processed data. The high CVSS score of 8.8 indicates significant risk for organizations using this product.
Recommendation
Immediately apply Oracle security updates for version 14.1.2.0.0. Restrict network access to the Core component and monitor for unusual activity.
Other vulnerabilities in Oracle Service Bus
See all- CVE-2026-87419High
Vulnerability in Oracle Service Bus (Core component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An easily exploitable flaw allows a low-privileged attacker with HTTP network access to take over Oracle Service Bus.
- CVE-2026-87369High
Vulnerability in Oracle Service Bus (component Core), affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can easily cause a hang or repeatable crash (complete DoS) of the product.
- CVE-2026-87364High
Vulnerability in Oracle Service Bus (component Core), affecting versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can easily take over the product.
- CVE-2026-87359High
Vulnerability in Oracle Service Bus (component Core), affecting versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can easily take over the product.
Original NVD description (English source)
Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus. Successful attacks of this vulnerability can result in takeover of Oracle Service Bus. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS