CVE-2026-60431: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. While the vulnerability is in Oracle HTTP Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. in Oracle Corporation Oracle HTTP Server
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_proxy). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. While the vulnerability is in Oracle HTTP Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
AI Analysis
Technical Summary
This vulnerability resides in the mod_proxy component of Oracle HTTP Server versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by unauthenticated attackers over the network via HTTP, allowing compromise of the Oracle HTTP Server. Successful exploitation can lead to unauthorized access to critical or all data accessible through the server. The vulnerability has a CVSS 3.1 score of 8.6 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, scope change, and high confidentiality impact without integrity or availability impact. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information). The Oracle Critical Patch Update advisory for July 2026 references multiple patches but does not explicitly confirm patch availability or remediation status for this vulnerability. No known exploits in the wild have been reported to date.
Potential Impact
An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain unauthorized access to critical or all data accessible through Oracle HTTP Server. The confidentiality of sensitive information is severely impacted. There is no impact on integrity or availability according to the CVSS vector. The vulnerability may also affect additional Oracle products due to scope change, potentially broadening the impact beyond Oracle HTTP Server itself.
Mitigation Recommendations
Oracle has released a Critical Patch Update advisory in July 2026 addressing numerous vulnerabilities across its product portfolio. However, the advisory does not explicitly confirm the availability of a patch or official fix for CVE-2026-60431. Customers should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is confirmed, monitor Oracle communications for updates. No vendor advisory states that no action is required or that the vulnerability is already mitigated. Therefore, applying Oracle's security patches promptly when available is strongly recommended.
CVE-2026-60431: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. While the vulnerability is in Oracle HTTP Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. in Oracle Corporation Oracle HTTP Server
Description
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_proxy). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. While the vulnerability is in Oracle HTTP Server, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
CVSS v3.1
Score 8.6high
Affected software
pkg:maven/com.oracle/oracle-http-serverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability resides in the mod_proxy component of Oracle HTTP Server versions 12.2.1.4.0 and 14.1.2.0.0. It is easily exploitable by unauthenticated attackers over the network via HTTP, allowing compromise of the Oracle HTTP Server. Successful exploitation can lead to unauthorized access to critical or all data accessible through the server. The vulnerability has a CVSS 3.1 score of 8.6 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, scope change, and high confidentiality impact without integrity or availability impact. The vulnerability is classified under CWE-200 (Exposure of Sensitive Information). The Oracle Critical Patch Update advisory for July 2026 references multiple patches but does not explicitly confirm patch availability or remediation status for this vulnerability. No known exploits in the wild have been reported to date.
Potential Impact
An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain unauthorized access to critical or all data accessible through Oracle HTTP Server. The confidentiality of sensitive information is severely impacted. There is no impact on integrity or availability according to the CVSS vector. The vulnerability may also affect additional Oracle products due to scope change, potentially broadening the impact beyond Oracle HTTP Server itself.
Mitigation Recommendations
Oracle has released a Critical Patch Update advisory in July 2026 addressing numerous vulnerabilities across its product portfolio. However, the advisory does not explicitly confirm the availability of a patch or official fix for CVE-2026-60431. Customers should consult the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Until a patch is confirmed, monitor Oracle communications for updates. No vendor advisory states that no action is required or that the vulnerability is already mitigated. Therefore, applying Oracle's security patches promptly when available is strongly recommended.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- oracle
- Date Reserved
- 2026-07-08T15:51:40.536Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://www.oracle.com/security-alerts/cpujul2026.html","vendor":"Oracle"}]
Threat ID: 6a5fede89c2644c7f8d591d4
Added to database: 07/21/2026, 22:08:40 UTC
Last enriched: 07/30/2026, 02:59:37 UTC
Last updated: 08/30/2026, 10:52:10 UTC
Views: 44
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.