Oracle HTTP Server — Cyber Threats, Attacks & Incidents

Overview

Oracle HTTP Server (OHS) is Oracle’s web server offering built on the Apache HTTP Server stack with Oracle-specific modules, used to deliver Oracle Fusion Middleware, E-Business Suite, and other Oracle applications. In cybersecurity, it represents a web-facing surface whose security posture depends on timely patching of OHS and underlying components (e.g., Apache Tika), as evidenced by recent critical vulnerabilities and large patch releases affecting Oracle products.

Related Threat Clusters

• Critical Vulnerabilities in Oracle Coherence and Access Manager Disclosed

  Multiple vulnerabilities affecting Oracle Coherence and Oracle Access Manager have been disclosed. CVE-2026-60248 and CVE-2026-60295 are critical vulnerabilities in Oracle Coherence, allowing attackers to potentially…

  10 articles · Updated July 23, 2026
• Oracle Releases January 2026 Critical Patch Update Addressing 337 Vulnerabilities

  On January 20, 2026, Oracle released its Critical Patch Update (CPU) for January 2026, addressing 337 security vulnerabilities across 122 products. This update includes fixes for 158 unique CVEs, with 27 patches…

  8 articles · Updated January 21, 2026
• Critical Vulnerability in Oracle HTTP Server and WebLogic Server

  A critical vulnerability (CVE-2026-21962) has been identified in Oracle HTTP Server and WebLogic Server Proxy Plug-in, allowing unauthenticated attackers to create, delete, or modify critical data. Oracle has released…

  2 articles · Updated January 22, 2026
• Multiple Vulnerabilities Exploited in Cybersecurity Threats

  Recent advisories detail multiple vulnerabilities affecting various software products. CVE-2026-21509, published on January 26, 2026, is under active exploitation and could allow unauthenticated remote code execution.…

  5 articles · Updated February 10, 2026
• CVE-2026 Assigned for Chromium Vulnerability Affecting Microsoft Edge

  CVE-2026 was assigned to address a vulnerability in Chromium, which is utilized by Microsoft Edge (Chromium-based). This vulnerability affects users of Microsoft Edge as it ingests the Chromium codebase. For further…

  116 articles · Updated February 6, 2026

Recent Intelligence Reports

• Oracle July 2026 CPU: pre-auth 10.0 RCE in WebLogic + more Suriq / 1d Strip it down to the software people actually self-host, and a much smaller set demands attention this week, a cluster of flaws an unauthenticated attacker can trigger over the network for full remote code execution, several scored a perfect CVSS 10.0. Any WebLogic Server, Oracle HTTP Server or Coherence instance reachable from the internet or an untrusted network, patched first, since these carry the unauthenticated 10.0 and — suriq.io · July 23, 2026
• Cyber alerts — Digital.Nhs.Uk · January 31, 2026
• CVE-2026-21962 — Arcticwolf · January 23, 2026
• CC-4739 — Digital.Nhs.Uk · January 22, 2026
• Critical Vulnerability in Oracle Products — Csa.Sg · January 22, 2026
• Oracle releases 337 security patches, including fix for critical Apache Tika flaw — Csoonline · January 21, 2026

Related Entities