External risk intelligence

Oracle HTTP Server OSSL Module Vulnerability Allows Data Compromise

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-87347

Oracle HTTP Server is a web server component commonly deployed as an internet-facing gateway, reverse proxy, or web application service. Because it is designed to handle network traffic and facilitate communication between external users and backend systems, it is frequently positioned at the network edge, making public internet exposure a standard and expected deployment pattern.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle HTTP Server, a product within Oracle Fusion Middleware. This issue, if exploited by an attacker with network access and limited privileges, could lead to unauthorized access, modification, or deletion of critical data handled by the server, potentially impacting other connected products.

Attackers can access sensitive data.
Crucial for protecting Oracle data integrity.
Confirm if your Oracle HTTP Server is exposed.

Attack Path

How an attacker could exploit the issue

An attacker with limited privileges could target the Oracle HTTP Server by accessing it over the network. This vulnerability exists within the OSSL Module of Oracle HTTP Server, and if successfully exploited, could lead to unauthorized modification or access to critical data.

Network access required.
Vulnerable OSSL Module component.
Unauthorized data access or modification.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Oracle HTTP Server could allow an attacker with limited privileges to gain unauthorized access to critical data or all accessible data. Such an attack could also impact other Oracle Fusion Middleware products. The threat involves unauthorized modification or access to data within the Oracle HTTP Server.

Critical data or all server accessible data.
Low privileged attacker gains network access.
Unauthorized data modification or access.

Operational Fix

Recommended remediation, mitigation, and detection steps

Attackers with low privileges can exploit this vulnerability in Oracle HTTP Server via HTTP, potentially leading to unauthorized access or modification of critical data. The first practical step is to identify all instances of Oracle HTTP Server, confirm their exposure and business criticality, and then assign ownership for remediation planning.

Application and Infrastructure teams own the issue.
Verify network accessibility and data impact.
Plan remediation and coordinate with vendors.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle HTTP Server and why is it used?

Oracle HTTP Server is a web server component built on Apache technology and included in Oracle Fusion Middleware. Organizations deploy it as a primary gateway to handle incoming web traffic, act as a reverse proxy for backend systems, or host web application services, effectively managing communication between users and enterprise data.

How does CVE-2026-87347 affect the OSSL Module?

This vulnerability indicates a flaw in how the OSSL module—the component responsible for Secure Sockets Layer operations—processes requests. It is a security weakness that allows an attacker to bypass standard controls, potentially leading to unauthorized data manipulation or theft across the server and connected systems.

Do I need to be a system administrator to trigger this bug?

No, you do not need administrative rights. The vulnerability is accessible to an attacker with only low-level privileges. However, the attacker must have network access to the server via HTTP. Local access or specialized permissions are not required for an attempt to be made.

How do I know if my systems are at risk based on Halo Surface Signal?

Halo Surface Signal indicates that because Oracle HTTP Server acts as a web gateway, it is frequently placed at the network edge to serve public traffic. If your instances are internet-facing to facilitate external communication, they are likely positioned in a way that aligns with this vulnerability's network-based attack vector.

What is the first step for teams managing Oracle HTTP Server?

Begin by creating a comprehensive inventory of all Oracle HTTP Server instances in your environment. Once identified, evaluate the network visibility and business sensitivity of each server. This foundational step allows your infrastructure teams to prioritize remediation efforts and coordinate with Oracle for necessary updates.

References

www.oracle.com/security-alerts/cpuoct2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.