This vulnerability affects Oracle HTTP Server 14.1.2.0.0 in the mod_http2.so component. It is easily exploitable by an attacker with low privileges who has logon access to the underlying infrastructure. The vulnerability can result in complete compromise of the Oracle HTTP Server, with high impacts on confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.8, reflecting a high severity. No vendor advisory explicitly states the availability of a patch for this specific vulnerability, but it is listed in Oracle's July 2026 Critical Patch Update advisory, which contains numerous patches for multiple products. The advisory strongly recommends applying patches promptly to mitigate risks.

Successful exploitation allows a low privileged attacker with logon access to the infrastructure to take over the Oracle HTTP Server, resulting in full compromise of confidentiality, integrity, and availability of the server.

Oracle's July 2026 Critical Patch Update advisory includes security patches addressing this vulnerability. Customers are strongly advised to apply the relevant patches from this update without delay. Patch status is not explicitly confirmed for this specific vulnerability in the advisory text provided; therefore, verify patch availability and installation instructions in the official Oracle Critical Patch Update documentation at https://www.oracle.com/security-alerts/cpujul2026.html.