CVE-2026-60431: Oracle HTTP Server Information Disclosure

CVE-2026-60431 Overview

CVE-2026-60431 is a high-severity vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware, specifically in the mod_proxy component. Affected versions include 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can exploit the flaw to compromise Oracle HTTP Server. The vulnerability carries a scope change, meaning successful attacks can impact additional products beyond Oracle HTTP Server. Exploitation can result in unauthorized access to critical data or complete access to all data accessible through Oracle HTTP Server.

Critical Impact
Unauthenticated network attackers can exploit mod_proxy to gain unauthorized read access to critical data, with scope change extending impact to additional Oracle products.

Affected Products

Oracle HTTP Server 12.2.1.4.0
Oracle HTTP Server 14.1.2.0.0
Oracle Fusion Middleware deployments using mod_proxy

Discovery Timeline

2026-07-21 - CVE-2026-60431 published to the National Vulnerability Database (NVD)
2026-07-21 - Oracle publishes Security Alert July 2026 addressing the issue
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60431

Vulnerability Analysis

The vulnerability resides in the mod_proxy component of Oracle HTTP Server, which handles proxying of HTTP requests to backend services. An unauthenticated remote attacker can send crafted HTTP requests over the network to trigger the flaw. The attack complexity is low, requires no privileges, and requires no user interaction.

Successful exploitation leads to high-impact confidentiality loss without affecting integrity or availability. The scope change indicates the vulnerable component can grant access to resources managed by other security authorities, extending the blast radius beyond Oracle HTTP Server itself. Attackers targeting this flaw can potentially exfiltrate sensitive data from downstream applications proxied through the affected server.

EPSS data as of 2026-07-23 reports an exploit probability of 0.303% at the 22.421 percentile, indicating no widespread exploitation activity has been observed. No public proof-of-concept exploit is available at this time.

Root Cause

Oracle has not published detailed root cause information. The vulnerability is scoped to the mod_proxy component of Oracle HTTP Server, which is responsible for forwarding client requests to backend origin servers. Improper handling within this proxy path allows an unauthenticated caller to reach sensitive data. See the Oracle Security Alert July 2026 for the authoritative fix details.

Attack Vector

The attack vector is network-based (AV:N) over HTTP. An attacker sends specially crafted HTTP requests to a listener on an affected Oracle HTTP Server instance where mod_proxy is configured. Because no authentication or user interaction is required, internet-facing Oracle HTTP Server deployments are directly reachable and at highest risk. The scope change means proxied backend applications may also expose data to the attacker.

No verified exploit code is publicly available. Refer to the Oracle Security Alert July 2026 for vendor-published technical details.

Detection Methods for CVE-2026-60431

Indicators of Compromise

Anomalous HTTP requests to Oracle HTTP Server endpoints configured with mod_proxy, especially requests with unusual URI patterns or proxy directives
Unexpected outbound requests from backend systems proxied through Oracle HTTP Server
Access log entries showing unauthenticated requests reaching resources normally requiring authentication

Detection Strategies

Inspect Oracle HTTP Server access and error logs for high volumes of requests to mod_proxy-handled routes from unknown source IP addresses
Deploy web application firewall (WAF) rules that flag malformed HTTP requests targeting proxy handlers
Correlate authentication logs of proxied backend applications against Oracle HTTP Server request logs to identify mismatches

Monitoring Recommendations

Enable verbose logging on mod_proxy and forward logs to a centralized SIEM for retention and analysis
Baseline normal request patterns to proxied endpoints and alert on statistical deviations
Monitor outbound traffic from Oracle HTTP Server instances for connections to unexpected internal or external hosts

How to Mitigate CVE-2026-60431

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0 instances without delay
Inventory all Oracle Fusion Middleware deployments and identify those exposing mod_proxy to untrusted networks
Restrict network access to Oracle HTTP Server management and proxy endpoints using firewall rules until patching is complete

Patch Information

Oracle addressed this vulnerability in the July 2026 Critical Patch Update. Administrators should download and apply the appropriate patches from the Oracle Security Alert July 2026. Verify patch application by confirming the installed Oracle HTTP Server version reflects the post-CPU release level.

Workarounds

If immediate patching is not possible, disable or restrict mod_proxy configurations on affected Oracle HTTP Server instances where feasible
Place affected instances behind a hardened reverse proxy or WAF that filters malformed HTTP requests
Limit inbound HTTP access to trusted source ranges until the vendor patch is deployed

bash

# Example: restrict inbound HTTP access at the host firewall until patched
# Allow only trusted management subnet to reach Oracle HTTP Server
iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP