CVE-2026-60438: Oracle HTTP Server Auth Bypass Flaw

CVE-2026-60438 Overview

CVE-2026-60438 is a vulnerability in the Oracle HTTP Server component of Oracle Fusion Middleware, specifically within mod_ssl. An unauthenticated attacker with network access over HTTP can compromise Oracle HTTP Server without user interaction. Successful exploitation leads to unauthorized creation, deletion, or modification of critical data, and full read access to all data accessible by Oracle HTTP Server.

Oracle disclosed the issue in the July 2026 Critical Patch Update. Affected supported versions are 12.2.1.4.0 and 14.1.2.0.0.

Critical Impact
Unauthenticated network attackers can read and modify all data accessible to Oracle HTTP Server, undermining confidentiality and integrity of Fusion Middleware deployments.

Affected Products

Oracle HTTP Server (Oracle Fusion Middleware) version 12.2.1.4.0
Oracle HTTP Server (Oracle Fusion Middleware) version 14.1.2.0.0
Component: mod_ssl

Discovery Timeline

2026-07-21 - CVE-2026-60438 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle addresses the issue in the Oracle Security Alert July 2026

Technical Details for CVE-2026-60438

Vulnerability Analysis

The flaw resides in mod_ssl within Oracle HTTP Server, the module responsible for TLS termination and cryptographic operations. An attacker reaches the vulnerable code path over the network using HTTP, without credentials or user interaction. Oracle's advisory classifies the issue as easily exploitable.

Successful exploitation grants the attacker read access to all data accessible by Oracle HTTP Server and the ability to create, delete, or modify that data. Availability is not affected, indicating the attack does not require crashing or halting the server to succeed. Because Oracle HTTP Server frequently fronts Fusion Middleware applications, exposed data may include session material, backend responses, and configuration artifacts.

Root Cause

Oracle has not published the underlying weakness classification (no CWE assigned in NVD). The advisory attributes the defect to mod_ssl in Oracle HTTP Server versions 12.2.1.4.0 and 14.1.2.0.0. Refer to the Oracle Security Alert July 2026 for vendor-supplied technical detail.

Attack Vector

The attack vector is network-based over HTTP. The attacker requires no authentication, no privileges, and no user interaction. The scope remains unchanged, meaning the impact is contained within Oracle HTTP Server's security scope, though that scope typically includes sensitive Fusion Middleware data.

No public proof-of-concept exploit is currently listed. The EPSS score is 0.303% (percentile 22.42) as of 2026-07-23, indicating low observed exploitation likelihood at publication.

No verified exploitation code is available. See the Oracle Security Alert July 2026 for vendor guidance.

Detection Methods for CVE-2026-60438

Indicators of Compromise

Anomalous HTTP or HTTPS requests to Oracle HTTP Server endpoints originating from untrusted networks, particularly requests targeting TLS handshake paths handled by mod_ssl.
Unexpected changes to files, configurations, or backend data served through Oracle HTTP Server that lack corresponding administrative activity.
Outbound data transfers from Oracle HTTP Server hosts to unfamiliar destinations following inbound HTTP activity.

Detection Strategies

Inventory all Oracle Fusion Middleware deployments and identify Oracle HTTP Server instances running 12.2.1.4.0 or 14.1.2.0.0.
Enable verbose access and error logging on mod_ssl and forward logs to a centralized analytics platform for pattern analysis.
Correlate web server telemetry with backend application audit logs to spot unauthorized data modification chains.

Monitoring Recommendations

Alert on spikes in HTTP request volume or new client identifiers hitting Oracle HTTP Server from outside expected source ranges.
Monitor filesystem integrity for Oracle HTTP Server configuration, key material, and served content directories.
Track process and network baselines on hosts running Oracle HTTP Server to identify deviations after suspicious HTTP activity.

How to Mitigate CVE-2026-60438

Immediate Actions Required

Apply the fixes from the Oracle Critical Patch Update Advisory - July 2026 to affected Oracle HTTP Server instances.
Restrict network exposure of Oracle HTTP Server to trusted networks and reverse proxies until patching is complete.
Audit recent Oracle HTTP Server logs and backend data stores for signs of unauthorized modification.

Patch Information

Oracle addresses CVE-2026-60438 in the July 2026 Critical Patch Update. Administrators running Oracle HTTP Server 12.2.1.4.0 or 14.1.2.0.0 must apply the corresponding patch bundle published by Oracle. Consult the Oracle Security Alert July 2026 for platform-specific patch identifiers and installation prerequisites.

Workarounds

Place Oracle HTTP Server behind a hardened reverse proxy or web application firewall that inspects and filters HTTP traffic to mod_ssl endpoints.
Limit inbound access to Oracle HTTP Server using network access control lists, restricting connections to known clients and management networks.
Rotate TLS keys, certificates, and any credentials handled by Oracle HTTP Server after patching, in case exposure occurred prior to remediation.

bash

# Example: restrict inbound access to Oracle HTTP Server via iptables
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A INPUT -p tcp --dport 80 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP