CVE-2026-60438

Analyzed Analyzed - Analysis Complete

Oracle HTTP Server mod_ssl Access Control Bypass

Publication date: 2026-07-21

Last updated on: 2026-08-01

Assigner: Oracle

Description

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: mod_ssl). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HTTP Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle HTTP Server accessible data as well as unauthorized access to critical data or complete access to all Oracle HTTP Server accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-08-01

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60438

EUVD

EUVD-2026-46835

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	http_server	12.2.1.4.0
oracle	http_server	14.1.2.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle HTTP Server's mod_ssl component affecting versions 12.2.1.4.0 and 14.1.2.0.0. It allows unauthenticated attackers to remotely access and compromise the server via HTTP. Successful exploitation can lead to unauthorized data modification, deletion, or access to all server data.

Detection Guidance

Detection of CVE-2026-60438 requires checking for vulnerable versions of Oracle HTTP Server (12.2.1.4.0 or 14.1.2.0.0). Inspect installed versions using server commands like 'httpd -v' or 'opatch lsinventory' for Oracle components. Monitor network traffic for unusual HTTP requests targeting mod_ssl. Ensure mod_ssl patches are applied and review server logs for unauthorized access attempts.

Impact Analysis

If you use affected Oracle HTTP Server versions, attackers could steal, alter, or delete sensitive data. They might gain full access to all server-stored information, including critical or confidential data, without needing authentication.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection standards like GDPR and HIPAA due to unauthorized data access and modification risks. Organizations using affected systems may face legal penalties, data breach notifications, and reputational damage.

Mitigation Strategies

Apply the latest Oracle HTTP Server patches for versions 12.2.1.4.0 and 14.1.2.0.0 to address the mod_ssl vulnerability. Disable HTTP access if not required or restrict network access via firewalls to reduce exposure.

Hi! I’m here to help you understand CVE-2026-60438. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70