CVE-2026-60454: High severity Oracle Oracle HTTP Server vulnerability
Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HTTP Server executes to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle Fusion Middleware - Oracle HTTP Server (Core)to a version that resolves this vulnerability.Fixed in 12.2.1.4.0 - Upgrade
Upgrade
Oracle Fusion Middleware - Oracle HTTP Server (Core)to a version that resolves this vulnerability.Fixed in 14.1.2.0.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-60454?
The severity of CVE-2026-60454 is high, with a score of 7.8.
What are the affected versions of CVE-2026-60454?
The affected versions of CVE-2026-60454 are 12.2.1.4.0 and 14.1.2.0.0 of Oracle HTTP Server.
How do I fix CVE-2026-60454?
To fix CVE-2026-60454, apply the latest security patches provided by Oracle for the affected Oracle HTTP Server versions.
Who can exploit CVE-2026-60454?
CVE-2026-60454 can be exploited by low privileged attackers with logon access to the infrastructure where Oracle HTTP Server runs.
What type of impact does CVE-2026-60454 have?
CVE-2026-60454 can lead to serious impacts including potential unauthorized access and data compromise due to its high criticality.