EUVD-2026-61871
GHSA-fc4v-ww23-4wv6
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-accessible via HTTPS with no authentication required per description; high complexity reflects 'difficult to exploit' qualifier; full takeover impact justifies C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Web Services Manager. Successful attacks of this vulnerability can result in takeover of Oracle Web Services Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Full takeover of Oracle Web Services Manager is achievable by unauthenticated remote attackers via HTTPS in versions 12.2.1.4.0 and 14.1.2.0.0 of the Oracle Fusion Middleware product line. The vulnerability resides in the Web Services Security component and carries a CVSS 3.1 base score of 8.1, with complete confidentiality, integrity, and availability impacts confirmed by Oracle's August 2026 Critical Patch Update advisory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network-level access to the Oracle Web Services Manager HTTPS service interface - no authentication credentials are needed, as confirmed by the CVSS vector's PR:N metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.1 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H places this at high severity: no authentication is required and no user interaction is needed, but the AC:H rating indicates that exploitation requires satisfying conditions that are not trivially reproducible - such as race conditions, specific protocol state, or environmental timing prerequisites that Oracle has not publicly characterized. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle Critical Patch Update for August 2026, available at https://www.oracle.com/security-alerts/cspuaug2026.html, which addresses this vulnerability in Oracle Web Services Manager 12.2.1.4.0 and 14.1.2.0.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all systems running Oracle Fusion Middleware versions 12.2.1.4.0 or 14.1.2.0.0 and validate their network exposure; immediately apply network segmentation to restrict inbound HTTPS access to these services via firewall rules or WAF policies allowing only authorized administrative sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Web Services Manager
View allPrivilege-scoped data compromise in Oracle Web Services Manager (OWSM), a component of Oracle Fusion Middleware versions
Unauthorized data compromise in Oracle Web Services Manager (OWSM), part of Oracle Fusion Middleware's Web Services Secu
Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: XML Security component)
Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security).
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today