Oracle Web Services Manager EUVD-2026-79617

No special conditions beyond network reachability to an exposed Oracle Web Services Manager Web Services Agent HTTP endpoint - the CVSS vector is AV:N/AC:L/PR:N/UI:N, so exploitation is unauthenticated and requires no user interaction or pre-existing privileges on default configurations. Practical limits: the agent component must actually be deployed and its HTTP listener reachable (Internet-facing or reachable from an untrusted network segment); instances where WSM is deployed purely internally behind strict segmentation are materially less exposed. Availability is unaffected (A:N) and integrity impact is partial (I:L), so this is primarily a data-disclosure/policy-tampering vector rather than a destructive one. The vendor provides no root-cause detail (no CWE), so any further precondition tied to a specific policy configuration or message format is unconfirmed from available data.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N, 8.2) describes a low-complexity, unauthenticated, network-reachable flaw with total confidentiality loss and partial integrity loss - the classic profile of an exploitable enterprise middleware defect. These signals point to a genuine priority for any organization exposing the WSM Web Services Agent to untrusted networks. Counterbalancing signals: no EPSS score was supplied, no POC is known, and the flaw is not in CISA KEV, so there is currently no evidence of automated or mass exploitation - this reads as an opportunistic-target risk rather than an active emergency. Note the caveat that the vendor description supplies no CWE and no root-cause detail, so the exact mechanism of the 'easily exploitable' bypass is unconfirmed; the CVSS vector is the only authoritative signal on preconditions, and it indicates none. Organizations should treat internet-facing or partner-facing WSM agent endpoints as actionable while deprioritizing purely internal, firewalled instances.

An attacker with network reachability to an exposed WSM Web Services Agent sends a crafted HTTP request designed to bypass the agent's authentication/policy validation step, receiving responses that contain protected service data or agent configuration. Because the vector is PR:N/UI:N/AC:L, no credentials, user interaction, or unusual conditions are needed - the attack can be scripted and repeated across hosts. If combined with the partial integrity impact, the attacker could also alter a subset of WSM-managed data, for example policy or service metadata used by downstream consumers.