External risk intelligence

Oracle HTTP Server Apache Plugin Takeover Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-60363

Oracle HTTP Server is a web server component typically deployed at the network edge to handle incoming HTTP traffic. As a public-facing web infrastructure component that accepts unauthenticated network connections, it is designed to be directly reachable from the internet in standard deployments.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle HTTP Server, a component of Oracle Fusion Middleware. This issue allows an attacker to gain full control of the server without needing any credentials, potentially impacting data confidentiality, integrity, and availability. The main concern is confirming if this technology is in use and if it is exposed.

Unauthenticated attackers can fully control the server.
Critical flaw impacts widely deployed web infrastructure.
Confirm relevance and exposure of Oracle HTTP Server.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could reach the Oracle HTTP Server from the network. By interacting with the Apache Plugin component, they could exploit an easily exploitable vulnerability. Successful exploitation could lead to a complete takeover of the server, impacting confidentiality, integrity, and availability.

Network access required.
Compromise through the Apache Plugin.
Full server takeover risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker with network access to compromise the Oracle HTTP Server. Successful attacks may lead to a complete takeover of the server, impacting confidentiality, integrity, and availability.

Oracle HTTP Server could be compromised.
Attackers can exploit network access via HTTP.
Server takeover is a realistic consequence.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Oracle HTTP Server, a component of Oracle Fusion Middleware, is susceptible to an easily exploitable vulnerability that allows for complete takeover. Given its role as a public-facing web server, the primary responsibility for addressing this critical vulnerability likely falls to infrastructure or platform teams, with close coordination from network and security teams. The first practical step involves identifying all instances of the affected Oracle HTTP Server, assessing their exposure and business criticality, and then confirming the accountable owner to plan a risk-based remediation strategy.

Infrastructure or Platform Team ownership.
Verify external reachability and business criticality.
Plan coordinated remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle HTTP Server and the Apache Plugin?

Oracle HTTP Server is a web server component within Oracle Fusion Middleware, designed to serve as a high-performance foundation for web applications. The Apache Plugin acts as a bridge, enabling the server to route requests effectively to other backend components. It is commonly deployed as a primary gateway to manage incoming web traffic, making it a critical interface for external users interacting with Oracle-based middleware environments.

What does this CVE-2026-60363 vulnerability actually mean?

This vulnerability is a critical security flaw that allows an unauthorized person to take complete control of the Oracle HTTP Server. Because it impacts the Apache Plugin, it disrupts the software's ability to safely process incoming network traffic. The flaw grants an attacker the same level of access as the server itself, allowing them to view sensitive data, modify information, or render the system completely unavailable.

How does an attacker trigger this issue?

An attacker triggers this vulnerability by sending specially crafted HTTP requests to the target server. Because the Apache Plugin component incorrectly processes this input, no authentication or login credentials are required to initiate the attack. Crucially, the vulnerability cannot be triggered unless the server is reachable via the network; it requires an active, unauthenticated network path to the affected component.

Is my server relevant to this threat?

According to Halo Surface Signal, this vulnerability is most relevant to instances that are internet-facing. Because Oracle HTTP Server is often positioned at the network edge to handle incoming connections, it is frequently exposed to the public internet. If your deployment is directly reachable from outside your internal network, the risk is significantly higher than for systems restricted to private, internal-only communication.

What should I do first to address this?

Your first step is to perform an inventory of all systems running the affected versions: 12.2.1.4.0 and 14.1.2.0.0. Once you have identified these instances, assess which ones are reachable from the internet or critical to your business operations. Assign a clear owner for these assets and coordinate with your infrastructure team to prioritize them for security updates, ensuring that remediation is handled in a way that minimizes impact to your live services.

References

www.oracle.com/security-alerts/cpujul2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.