CVE-2026-60363: Oracle HTTP Server RCE Vulnerability

CVE-2026-60363 Overview

CVE-2026-60363 is a critical vulnerability in the Apache Plugin component of Oracle HTTP Server, part of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can exploit the vulnerability without user interaction. Successful exploitation results in full takeover of the Oracle HTTP Server, compromising confidentiality, integrity, and availability. Oracle disclosed the issue in its July 2026 Critical Patch Update.

Critical Impact
Unauthenticated remote attackers can achieve complete takeover of Oracle HTTP Server instances over the network.

Affected Products

Oracle HTTP Server 12.2.1.4.0 (Apache Plugin component)
Oracle HTTP Server 14.1.2.0.0 (Apache Plugin component)
Oracle Fusion Middleware deployments using the affected Oracle HTTP Server versions

Discovery Timeline

2026-07-21 - CVE-2026-60363 published to the National Vulnerability Database
2026-07-21 - Last updated in the NVD database

Technical Details for CVE-2026-60363

Vulnerability Analysis

The vulnerability resides in the Apache Plugin component of Oracle HTTP Server, the web tier front-end for Oracle Fusion Middleware. Oracle rates the issue as easily exploitable and network-reachable through HTTP, with no authentication required. Successful exploitation yields full takeover of the Oracle HTTP Server process, giving the attacker control over hosted applications, routed traffic, and back-end connections to WebLogic and other middleware tiers. Because Oracle HTTP Server frequently sits at the network edge, compromise provides a foothold for lateral movement into enterprise application infrastructure. Oracle has not publicly disclosed the underlying weakness class, but the impact profile is consistent with remote code execution against the HTTP server process.

Root Cause

Oracle's advisory does not enumerate the underlying weakness (no CWE has been assigned). The defect is scoped to the Apache Plugin subcomponent shipped with Oracle HTTP Server versions 12.2.1.4.0 and 14.1.2.0.0. Refer to the Oracle Security Alert July 2026 for the vendor's technical description as it becomes available.

Attack Vector

The attack path is entirely network based. An unauthenticated attacker sends crafted HTTP requests to an exposed Oracle HTTP Server endpoint. No user interaction, no privileges, and no local access are required. Because Oracle HTTP Server routinely terminates public HTTPS traffic for Fusion Middleware, internet-exposed instances are directly reachable and can be probed at scale.

No verified proof-of-concept code has been published. See the Oracle Security Alert July 2026 for authoritative technical details.

Detection Methods for CVE-2026-60363

Indicators of Compromise

Unexpected child processes spawned by the Oracle HTTP Server (ohs) or httpd process tree.
Anomalous outbound network connections originating from the Oracle HTTP Server host to unknown destinations.
New or modified files under the Oracle HTTP Server instances/ and config/ directories that do not correspond to scheduled changes.
HTTP requests with malformed headers, unusually long URIs, or unexpected methods targeting Apache Plugin routes.

Detection Strategies

Inventory all Oracle Fusion Middleware deployments and identify hosts running Oracle HTTP Server 12.2.1.4.0 or 14.1.2.0.0.
Correlate web server access logs with process execution telemetry to flag request patterns that precede shell or interpreter execution.
Alert on Oracle HTTP Server processes writing to web-accessible directories, which may indicate webshell deployment.

Monitoring Recommendations

Forward Oracle HTTP Server access and error logs to a centralized analytics platform for behavioral baselining.
Monitor egress traffic from middleware hosts for connections to non-corporate infrastructure.
Track authentication and configuration changes on downstream WebLogic and database tiers that trust the Oracle HTTP Server.

How to Mitigate CVE-2026-60363

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0 instances.
Restrict inbound HTTP and HTTPS access to Oracle HTTP Server to trusted networks until patching is complete.
Review Oracle HTTP Server hosts for signs of exploitation, focusing on process, file, and network anomalies.

Patch Information

Oracle addresses CVE-2026-60363 in the Oracle Security Alert July 2026. Administrators should follow Oracle's documented patch procedure for Fusion Middleware, apply the corresponding Apache Plugin fix for both 12.2.1.4.0 and 14.1.2.0.0, and validate that the OHS instances restart cleanly.

Workarounds

Place a web application firewall in front of Oracle HTTP Server and block anomalous requests targeting Apache Plugin endpoints.
Disable or remove unused Apache Plugin modules if operationally feasible.
Enforce network segmentation so that only authorized upstream proxies can reach Oracle HTTP Server listeners.

bash

# Example: restrict inbound HTTP/HTTPS to Oracle HTTP Server using iptables
iptables -A INPUT -p tcp --dport 443 -s <trusted_proxy_cidr> -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A INPUT -p tcp --dport 80  -s <trusted_proxy_cidr> -j ACCEPT
iptables -A INPUT -p tcp --dport 80  -j DROP