CVE-2026-60454: Oracle HTTP Server RCE Vulnerability

CVE-2026-60454 Overview

CVE-2026-60454 is a high-severity local privilege escalation vulnerability in the Core component of Oracle HTTP Server, part of Oracle Fusion Middleware. Affected supported versions are 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with a valid logon to the infrastructure hosting Oracle HTTP Server can exploit the flaw to fully compromise the server. Successful exploitation results in a complete takeover of Oracle HTTP Server, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in the Oracle Security Alert July 2026.

Critical Impact
Successful exploitation grants full takeover of Oracle HTTP Server, exposing hosted applications, credentials, and backend Fusion Middleware services.

Affected Products

Oracle HTTP Server 12.2.1.4.0
Oracle HTTP Server 14.1.2.0.0
Oracle Fusion Middleware deployments using the affected Core component

Discovery Timeline

2026-07-21 - CVE-2026-60454 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Disclosed in the Oracle Critical Patch Update / Security Alert cycle

Technical Details for CVE-2026-60454

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle HTTP Server, the web tier of Oracle Fusion Middleware. According to Oracle, the flaw is easily exploitable by an attacker with low privileges and local logon to the host running Oracle HTTP Server. No user interaction is required, and the scope remains unchanged, meaning the compromise is bounded to the Oracle HTTP Server security authority. However, that authority typically includes web server processes, configuration files, TLS private keys, and proxied application traffic. An attacker abusing this weakness can pivot from a low-privileged local account to full control over the HTTP tier, which frequently fronts business-critical Fusion Middleware and Oracle E-Business Suite deployments.

Root Cause

Oracle has not published root cause specifics beyond identifying the Core component and the local, low-privilege exploitation profile. The advisory attributes high confidentiality, integrity, and availability impact to a single flaw reachable by an authenticated local user. Consult the Oracle Security Alert July 2026 for vendor-provided technical detail as it becomes available.

Attack Vector

Exploitation requires local access (AV:L) and low privileges (PR:L) on the host running Oracle HTTP Server. This maps to any user account permitted to log on to the middleware server, including compromised service accounts, jump-host users, or lateral-movement footholds. The attacker leverages that local access against the Oracle HTTP Server process or its resources to escalate to full server takeover. No network-facing precondition and no user interaction are needed, which makes the flaw attractive as a second-stage escalation primitive after initial access.

Detection Methods for CVE-2026-60454

Indicators of Compromise

Unexpected modification of Oracle HTTP Server configuration files under $ORACLE_HOME or the instance config directory
New or altered child processes spawned by the Oracle HTTP Server (httpd/ohs) parent process
Unauthorized reads or copies of TLS private keys, wallet files, and mod_wl_ohs configuration
Local logons from service or low-privilege accounts followed by writes to Oracle HTTP Server binaries or modules

Detection Strategies

Baseline the Oracle HTTP Server process tree and alert on deviations, particularly shells or interpreters spawned from httpd
Monitor file integrity on Oracle HTTP Server binaries, configuration, and module directories
Correlate local authentication events with subsequent access to Oracle HTTP Server-owned files
Review Oracle HTTP Server access and error logs for anomalous administrative endpoints or module loads

Monitoring Recommendations

Ingest OS authentication, process, and file-integrity telemetry from middleware hosts into a centralized analytics platform
Alert on privilege changes affecting the oracle or Fusion Middleware runtime account
Track outbound connections initiated by the Oracle HTTP Server process for signs of post-exploitation callbacks
Review privileged local account usage on middleware tiers weekly and reconcile against change tickets

How to Mitigate CVE-2026-60454

Immediate Actions Required

Apply the fixes bundled in the Oracle Critical Patch Update referenced by the Oracle Security Alert July 2026
Inventory Oracle HTTP Server instances and confirm versions against 12.2.1.4.0 and 14.1.2.0.0
Restrict interactive and remote logon to middleware hosts to a minimal set of administrators
Rotate credentials, TLS keys, and wallet passwords on any host suspected of unauthorized local access

Patch Information

Oracle addressed CVE-2026-60454 through its July 2026 security update. Administrators should apply the patches identified in the Oracle Security Alert July 2026 for Oracle HTTP Server 12.2.1.4.0 and 14.1.2.0.0. Because the issue is local and requires an authenticated foothold, patching should be paired with a review of who holds shell access to the middleware tier.

Workarounds

Enforce least privilege on middleware hosts and remove shell access for non-administrative accounts
Isolate Oracle HTTP Server hosts in a dedicated management VLAN with strict jump-host controls
Enable mandatory access controls such as SELinux or AppArmor profiles around the httpd/ohs runtime
Require multi-factor authentication for any interactive logon to Fusion Middleware servers

bash

# Verify installed Oracle HTTP Server version before and after patching
$ORACLE_HOME/OPatch/opatch lsinventory | grep -i "Oracle HTTP Server"

# Restrict interactive logon on Linux middleware hosts (example)
sudo usermod -s /sbin/nologin <low_privilege_account>

# Enable auditd rules to monitor Oracle HTTP Server config changes
sudo auditctl -w $ORACLE_HOME/user_projects/domains -p wa -k ohs_config