CVE-2026-91419CWE-269privilege-escalation

CVE-2026-91419

High · published October 21, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
5.1
In the wild
Unconfirmed
What it is

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HTTP Server executes to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in takeover of Oracle HTTP Server. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00162 · 5.1th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2026-10-21T02:20Z
References (1)
https://www.oracle.com/security-alerts/cpuoct2026.html · [email protected]
EPSS history
Timeline
  • 22 OCT 03:36Z
    EPSS moved — → 0%
    epss
  • 20 OCT 21:25Z
    Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module)
    cvelistv5
  • 20 OCT 21:25Z
    Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OSSL Module)
    cvelistv5