EUVD-2026-61415
GHSA-qp55-9r3c-p2h4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach OWSM HTTP endpoint
-
DeliverySend crafted request bypassing WS-Security
-
ExploitAuthenticate as trusted/skip auth check
-
ExecutionRead or modify protected data
-
ImpactExfiltrate or tamper critical data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against Oracle Web Services Manager 12.2.1.4.0 or 14.1.2.0.0, per AV:N/AC:L/PR:N/UI:N. The only prerequisite is network reachability to an OWSM/Web Services Security endpoint (typically a WebLogic-hosted Fusion Middleware service). Limiting factors: the target must actually run one of the two affected versions with OWSM policy enforcement exposed, and exposure is reduced where these endpoints are segmented behind internal networks, VPNs, or filtering proxies rather than internet-facing. No user interaction and no authentication are required, which removes the usual social-engineering or credential-theft barriers. |
| Impact | The signals converge on genuine priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction - the easiest possible attack profile - and Oracle itself describes it as 'easily exploitable.' The 9.1 score reflects total loss of confidentiality and integrity (C:H/I:H) with no availability impact (A:N), so the risk is data theft and tampering rather than denial of service. Offsetting factors: no EPSS score was provided, the CVE is not in CISA KEV, and no POC or active-exploitation evidence is present in the data, so exploitation is currently unproven despite the low technical barrier. The combination of unauthenticated bypass, high blast radius, and a security-enforcement product that gates other services makes this a high-priority patch even absent an EPSS or KEV signal; treat the missing EPSS/KEV data as 'not yet observed' rather than 'low risk.' |
| Exploit ScenarioDerived | An attacker who can reach an OWSM-protected endpoint over HTTP sends crafted requests that bypass the Web Services Security policy enforcement, then reads and modifies protected data - for example exfiltrating sensitive records and altering or deleting records that OWSM governs - all without any credentials. Because AC:L and PR:N apply, this requires no special timing or prior access; no public POC is identified at time of analysis, so an attacker would need to develop the exploit independently. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Unauthorized data compromise in Oracle Web Services Manager (OWSM), part of Oracle Fusion Middleware's Web Services Security component, lets a remote unauthenticated attacker read, create, delete, or modify all OWSM-accessible data over HTTP. Tagged as an authentication bypass, it affects versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
RemediationAI
Apply the fixes delivered in Oracle's August 2026 Critical Patch Update; patch is available per vendor advisory at https://www.oracle.com/security-alerts/cspuaug2026.html, though the exact patched build number is not enumerated in the provided data and should be taken from the CPU patch matrix for your specific version (12.2.1.4.0 or 14.1.2.0.0). Because Oracle CPU fixes are cumulative, install the full CPU rather than an isolated one-off. Until patching completes, reduce exposure by restricting network access to OWSM and its WebLogic administration/web-service endpoints to trusted management networks and placing them behind a reverse proxy or WAF that can filter anomalous SOAP/REST security-header traffic; note this may block legitimate partner integrations that call these services directly, so validate allowlists before enforcing. Do not rely on a workaround as a substitute - an unauthenticated bypass in the security-policy layer is best closed by the vendor patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Web Services Manager is the policy-enforcement and security layer of Oracle Fusion Middleware, responsible for authenticating, authorizing, and applying WS-Security policies (signing, encryption, token validation) to SOAP/REST web services deployed on WebLogic-based middleware. The 'Web Services Security' component named in the advisory handles credential and token processing at the message layer, and the 'Authentication Bypass' tag indicates the flaw likely resides in how these security policies or tokens are validated, allowing requests to be processed as if authenticated. No CWE was assigned in the source data, but the behavior is consistent with an authentication/authorization bypass class (e.g., improper authentication, CWE-287, or improper access control, CWE-284); this is inferred from the tag and impact, not confirmed by a vendor CWE mapping.
Know when Web Services Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Vendor describes easily exploitable unauthenticated HTTP access (AV:N/AC:L/PR:N/UI:N) with full confidentiality and integrity loss but no availability impact, matching the published vector.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Services Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Web Services Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Web Services Manager accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle Web Services Manager (OWSM), a critical security component for web services in Oracle Fusion Middleware, is vulnerable to an authentication bypass that allows unauthenticated attackers to compromise, modify, or delete sensitive data with no current patch available. Organizations operating OWSM versions 12.2.1.4.0 or 14.1.2.0.0 face immediate risk of uncontrolled data exposure across their entire web services infrastructure until mitigation or upgrade can be deployed.
No vendor-released patch identified at time of analysis. Implement interim mitigations: (1) Network isolation-restrict all OWSM access to trusted internal networks only using firewall and network segmentation; (2) Monitoring and alerting-deploy continuous audit logging on all OWSM operations with real-time alerts for data access, creation, deletion, and modification events; (3) WAF deployment-configure rules to block suspicious OWSM requests and enforce strict request validation; (4) Access controls-implement principle of least privilege on all OWSM service accounts and API credentials. Monitor Oracle Security Advisories continuously for patch releases and maintain escalation procedures to apply patches within 24 hours of availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Web Services Manager
View allPrivilege-scoped data compromise in Oracle Web Services Manager (OWSM), a component of Oracle Fusion Middleware versions
Full takeover of Oracle Web Services Manager is achievable by unauthenticated remote attackers via HTTPS in versions 12.
Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: XML Security component)
Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security).
Exploit-DB