Oracle Web Services Manager CVE-2026-70924

Exploitation requires network-level access to the Oracle Web Services Manager HTTPS service interface - no authentication credentials are needed, as confirmed by the CVSS vector's PR:N metric. The high attack complexity rating (AC:H) indicates that exploitation depends on specific conditions not present in every connection attempt, such as a particular protocol state, timing window, or environmental prerequisite; Oracle has not publicly disclosed what those conditions are. The unchanged scope (S:U) means that successful exploitation does not inherently allow escape beyond the Oracle Web Services Manager process boundary to other systems. Exploitation is concretely limited by the AC:H rating (preventing trivial automated scanning success), the requirement for HTTPS network reachability to the WSM service (typically not directly internet-exposed in hardened enterprise deployments), and the current absence of any public exploit or proof-of-concept code.

The CVSS 3.1 score of 8.1 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H places this at high severity: no authentication is required and no user interaction is needed, but the AC:H rating indicates that exploitation requires satisfying conditions that are not trivially reproducible - such as race conditions, specific protocol state, or environmental timing prerequisites that Oracle has not publicly characterized. This distinction matters operationally: even a mid-sized municipal IT team in gdynia managing Oracle Fusion Middleware deployments should treat this as an urgent patching priority rather than a theoretical concern, since the no-privileges-required nature means any network-reachable WSM instance is a candidate target for sufficiently capable attackers. No EPSS score was present in the provided data, and the vulnerability is not yet listed in CISA's KEV catalog, nor has any public proof-of-concept been identified - these are meaningful limiting signals at this stage. However, AC:H alone should not be treated as a reliable deterrent against well-resourced threat actors with time to develop bespoke exploitation techniques. The absence of a CWE classification is a notable data gap that prevents confident assessment of exploitability patterns or likely exploit-code maturity trajectories.

A remote attacker with network-level access to the Oracle Web Services Manager HTTPS interface crafts a specially formed request targeting the Web Services Security component, satisfying the high-complexity preconditions required for successful exploitation. Upon exploitation, the attacker achieves full compromise of the Oracle Web Services Manager instance - with the ability to read sensitive policy and credential data, modify security configurations, disrupt availability, and potentially pivot to connected Fusion Middleware services. No public proof-of-concept code has been identified at time of analysis, indicating that exploitation currently demands significant attacker sophistication and likely bespoke tooling.