Oracle Web Services Manager CVE-2026-61001

Exploitation requires network access over HTTP to an Oracle Web Services Manager endpoint and a low-privileged account (CVSS PR:L), with no user interaction and low attack complexity (AC:L); it applies to OWSM in Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0. The specific product feature at risk is the Web Services Security component's policy/authentication enforcement (reporter-tagged 'Authentication Bypass'). Limiting factors that reduce real-world risk: the attacker must already possess some low-level privilege rather than being fully anonymous, and the target OWSM interface must be network-reachable - deployments that isolate OWSM/WebLogic behind restricted management networks materially raise the bar. Availability is not affected (A:N), so this is a data confidentiality/integrity threat, not a denial-of-service vector.

The signals lean toward genuine priority: CVSS 3.1 is 9.6 with AV:N/AC:L/PR:L/UI:N, meaning network-reachable, low complexity, only low privileges, and no user interaction - Oracle itself characterizes it as 'easily exploitable.' Impact is high for confidentiality and integrity but none for availability (A:N), and the scope change means a compromise of OWSM can cascade into other Fusion Middleware products it secures. No EPSS score was provided, no POC is referenced, and it is not in CISA KEV, so there is currently no evidence of active or automated exploitation - the urgency derives from exploitability and blast radius rather than observed attacks. One caveat to verify with the vendor: the reporter tags this 'Authentication Bypass,' yet the CVSS vector requires PR:L (some existing privilege); confirm whether a low-privileged foothold is truly required or whether the bypass reduces the effective privilege prerequisite.

An attacker who holds a low-privileged account (or a foothold reachable over the network) sends crafted HTTP requests to an OWSM-secured web service endpoint, abusing the Web Services Security enforcement flaw to bypass intended access controls. This lets them read and alter critical data across all OWSM-accessible resources, and because of the scope change, pivot into other Fusion Middleware products that rely on OWSM for security. No public POC is referenced, but the low attack complexity makes reliable exploitation plausible once details are known.