CVE-2026-60363: Oracle HTTP Server Remote Takeover – Detection & Hardening Guide

A critical remote code execution (RCE) vulnerability, CVE-2026-60363, has been identified in the Oracle HTTP Server (OHS), a core component of Oracle Fusion Middleware. With a CVSS 3.1 Base Score of 9.8, this flaw represents a severe risk to enterprise environments running supported versions 12.2.1.4.0 and 14.1.2.0.0.

The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the Oracle HTTP Server completely. Given the widespread use of Fusion Middleware in enterprise application delivery, this issue provides a trivial pathway for adversaries to gain an initial foothold or move laterally across the network. Security teams must treat this as an emergency patching event.

Technical Analysis

Affected Products & Versions:

• Product: Oracle Fusion Middleware (Oracle HTTP Server)
• Component: Apache Plugin
• Affected Versions: 12.2.1.4.0 and 14.1.2.0.0

Vulnerability Mechanics: CVE-2026-60363 is an easily exploitable flaw within the Apache Plugin integration layer of the Oracle HTTP Server. The vulnerability does not require authentication (PR:N) and has low attack complexity (AC:L). The attack vector is Network (AV:N) via standard HTTP requests.

From a defender's perspective, the vulnerability likely involves improper input validation or a memory corruption error (such as a buffer overflow) in how the Apache Plugin handles specific HTTP headers or request parameters. Successful exploitation allows the attacker to execute arbitrary code with the privileges of the OHS process (typically oracle or www-data). This results in a total loss of Confidentiality, Integrity, and Availability (C:H/I:H/A:H), effectively granting the attacker full control over the web server tier.

Exploitation Status: As of the NVD publication, CVE-2026-60363 is rated "Easily Exploitable." While the news summary confirms the theoretical mechanics, security teams should assume Proof-of-Concept (PoC) exploit code is imminent, if not already available in exploit databases, given the high CVSS score and the ubiquity of the target.

Detection & Response

To mitigate the risk of active exploitation before patching, defenders should hunt for anomalous process execution patterns originating from the web server daemon.

SIGMA Rules

The following Sigma rules detect suspicious child processes spawned by the Oracle HTTP Server (httpd) and unexpected outbound network connections, which are typical behaviors post-exploitation.

---
title: Suspicious Child Process Spawn by Oracle HTTP Server
id: 55d9a23-0f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects potential RCE exploitation of CVE-2026-60363 by monitoring Oracle HTTP Server (httpd) spawning shells or system utilities.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-60363
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: '/httpd'
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/zsh'
      - '/nc'
      - '/perl'
      - '/python'
      - '/python3'
  condition: selection
falsepositives:
  - Authorized administrative tasks via legitimate CGI scripts
level: critical
---
title: Outbound Network Connection from Oracle HTTP Server
id: 7a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects unauthorized outbound network traffic from Oracle HTTP Server, potentially indicating C2 beaconing or data exfiltration post-exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-60363
author: Security Arsenal
date: 2026/04/15
tags:
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith: '/httpd'
    DestinationPort:
      - 4444
      - 5555
      - 6666
      - 8080
      - 8443
  condition: selection
falsepositives:
  - Legitimate webhooks or reverse proxy functionality to internal backends
level: high

KQL (Microsoft Sentinel / Defender)

Use this KQL query to hunt for processes spawned by the HTTP daemon within your Linux logs ingested via the Syslog or Microsoft Defender for Endpoint connector.

DeviceProcessEvents
| where Timestamp > ago(1d)
| where InitiatingProcessFileName in~ ("httpd", "apache", "oracle_http_server")
| where ProcessFileName !in~ ("httpd", "httpd.worker", "httpd.event") 
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, ProcessFileName, ProcessCommandLine, InitiatingProcessId
| order by Timestamp desc

Velociraptor VQL

This Velociraptor artifact hunts for suspicious child processes of the HTTP daemon and active network connections established by the httpd parent.

-- Hunt for suspicious processes spawned by httpd
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime, Parent.Pid AS ParentPid, Parent.Name AS ParentName
FROM pslist()
WHERE Parent.Name =~ "httpd"
   AND Name NOT IN ("httpd", "httpd.worker", "sendmail", "rotatelogs")

-- Hunt for outbound network connections from httpd
SELECT Fd, Family, RemoteAddr, RemotePort, State, Pid.Name
FROM netstat()
WHERE Pid.Name =~ "httpd"
  AND RemoteAddr != "0.0.0.0"
  AND RemotePort != 0

Remediation Script (Bash)

This script checks for the presence of the affected Oracle HTTP Server versions and verifies if the patch has been applied by checking the OPatch inventory.

#!/bin/bash

# Check for affected Oracle HTTP Server versions
echo "Checking for affected Oracle Fusion Middleware versions..."

# Define Middleware Home (Change as necessary or iterate known paths)
MW_HOME="/u01/app/oracle/middleware"

if [ -d "$MW_HOME" ]; then
    # Look for Oracle HTTP Server installation details
    # Note: Actual version checking may require inspecting config.xml or running opatch lsinventory
    echo "Middleware Home found at $MW_HOME"
    echo "Running OPatch inventory to check patch status..."
    
    # OPatch check (Requires Oracle user privileges)
    # $MW_HOME/OPatch/opatch lsinventory | grep -E "(12.2.1.4.0|14.1.2.0.0)"
else
    echo "Middleware Home not found at default path. Please verify installation directories."
fi

echo "REMEDIATION INSTRUCTIONS:"
echo "1. Download the Critical Patch Update (CPU) for Oracle Fusion Middleware from Oracle Support."
echo "2. Apply the patch specific to CVE-2026-60363 for versions 12.2.1.4.0 and 14.1.2.0.0."
echo "3. Restart all Oracle HTTP Server instances and OPMN managed processes."
echo "4. Validate the patch using: $MW_HOME/OPatch/opatch lsinventory -details"

Remediation

1. Patch Immediately: Apply the security patch referenced in the Oracle Critical Patch Update advisory for CVE-2026-60363. This is the only complete remediation.

   • For Version 12.2.1.4.0: Apply the specific patch set provided by Oracle.
   • For Version 14.1.2.0.0: Apply the specific patch set provided by Oracle.

2. Vendor Advisory: Review the official Oracle Security Alert for detailed patching instructions and dependencies.

   • Advisory URL: https://www.oracle.com/security-alerts/

3. Network Segmentation: If patching is delayed immediately, strictly limit network access to the Oracle HTTP Server. Ensure that only trusted load balancers or reverse proxies can communicate with the OHS backend, and block direct internet access to the management ports.

4. Post-Patch Validation: After patching, verify the version string in the OHS configuration or use opatch lsinventory to ensure the patch was successfully applied.

5. Monitor Logs: Review OHS access and error logs (access_log, error_log) for signs of exploitation attempts dating back to the publication of the CVE.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub