Oracle HTTP Server OSSL Module Flaw CVE-2026-87347 Allows Data Manipulation

A critical vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware allows attackers to compromise data integrity and confidentiality. The flaw, identified as CVE-2026-87347, exists within the OSSL Module component. According to the National Vulnerability Database, this issue enables low-privileged attackers with network access via HTTP to gain unauthorized access to critical data. The vulnerability also permits the creation, deletion, or modification of data accessible to the server, posing a significant risk to environments running affected versions.

Root cause

The vulnerability originates in the OSSL Module of the Oracle HTTP Server. This component is part of the broader Oracle Fusion Middleware suite. The National Vulnerability Database describes the weakness as easily exploitable, allowing an attacker to compromise the server through standard HTTP network access. The flaw impacts both confidentiality and integrity, as indicated by the high CVSS metrics. Because the vulnerability is in the HTTP Server, attacks may significantly impact additional products due to scope change, expanding the potential blast radius beyond the immediate component.

Attack path

An attacker requires network access via HTTP to exploit CVE-2026-87347. The vulnerability does not require user interaction, meaning automated scanning tools or remote attackers can trigger the issue without any action from a legitimate user. The attacker needs only low privileges to initiate the exploit. Once successful, the attacker can create, delete, or modify access to critical data. They can also gain complete access to all data that the Oracle HTTP Server can access, effectively bypassing intended security controls and compromising the system's data protection mechanisms.

Affected versions

The National Vulnerability Database specifies that the following supported versions of Oracle HTTP Server are affected by this vulnerability:

• Oracle HTTP Server version 12.2.1.4.0
• Oracle HTTP Server version 14.1.2.0.0

Organizations running these specific versions within their Oracle Fusion Middleware deployments are exposed to the risks described in the CVE record. Other versions are not listed as affected in the provided source material, but administrators should verify their specific deployment configurations against vendor advisories to ensure accurate risk assessment.

Mitigation

• Verify if your environment runs Oracle HTTP Server versions 12.2.1.4.0 or 14.1.2.0.0.
• Restrict network access to the HTTP Server to limit exposure to untrusted networks.
• Monitor for unauthorized data creation, deletion, or modification attempts on the server.
• Review access logs for signs of low-privileged accounts performing high-impact actions.
• Ensure that the OSSL Module is configured with strict access controls where possible.
• Consult Oracle Fusion Middleware documentation for any available patches or workarounds.

Signals worth monitoring

Security teams should monitor web server access logs for unusual HTTP requests originating from low-privileged accounts or unexpected IP ranges. Look for spikes in data modification operations, such as frequent create, delete, or update actions, especially during off-hours. Alert on any successful authentication events followed immediately by bulk data access or changes. Check for anomalies in the OSSL Module activity, such as unexpected certificate operations or configuration changes. Teams usually correlate these signals with network traffic patterns to identify potential exploitation attempts early.

What to do and how to stay safe: Oracle HTTP Server

• Inventory all instances of Oracle HTTP Server to identify systems running versions 12.2.1.4.0 or 14.1.2.0.0.
• Implement network segmentation to restrict HTTP access to the OSSL Module from untrusted networks.
• Enable detailed logging on the web server to capture all HTTP requests and responses for forensic analysis.
• Once the vendor provides an update, apply the patch promptly to remediate the vulnerability.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-87347?

The CVSS 3.1 Base Score is 9.6, which is rated Critical by the National Vulnerability Database.

Which specific component of Oracle Fusion Middleware is affected?

The vulnerability is in the OSSL Module component of the Oracle HTTP Server product.

Does exploiting this vulnerability require user interaction?

No, the vulnerability does not require user interaction, allowing remote exploitation via HTTP.