Web Services Manager
Monthly
Full takeover of Oracle Web Services Manager is achievable by unauthenticated remote attackers via HTTPS in versions 12.2.1.4.0 and 14.1.2.0.0 of the Oracle Fusion Middleware product line. The vulnerability resides in the Web Services Security component and carries a CVSS 3.1 base score of 8.1, with complete confidentiality, integrity, and availability impacts confirmed by Oracle's August 2026 Critical Patch Update advisory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Privilege-scoped data compromise in Oracle Web Services Manager (OWSM), a component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, allows a low-privileged attacker with HTTP network access to read and modify all OWSM-accessible critical data, with a scope change that can significantly impact additional integrated products. Tagged by the reporter as an authentication bypass, the flaw carries a CVSS 3.1 base score of 9.6 driven by high confidentiality and integrity impact plus scope change. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Web Services Manager (OWSM), part of Oracle Fusion Middleware's Web Services Security component, lets a remote unauthenticated attacker read, create, delete, or modify all OWSM-accessible data over HTTP. Tagged as an authentication bypass, it affects versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: XML Security component). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Full takeover of Oracle Web Services Manager is achievable by unauthenticated remote attackers via HTTPS in versions 12.2.1.4.0 and 14.1.2.0.0 of the Oracle Fusion Middleware product line. The vulnerability resides in the Web Services Security component and carries a CVSS 3.1 base score of 8.1, with complete confidentiality, integrity, and availability impacts confirmed by Oracle's August 2026 Critical Patch Update advisory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.
Privilege-scoped data compromise in Oracle Web Services Manager (OWSM), a component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, allows a low-privileged attacker with HTTP network access to read and modify all OWSM-accessible critical data, with a scope change that can significantly impact additional integrated products. Tagged by the reporter as an authentication bypass, the flaw carries a CVSS 3.1 base score of 9.6 driven by high confidentiality and integrity impact plus scope change. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Web Services Manager (OWSM), part of Oracle Fusion Middleware's Web Services Security component, lets a remote unauthenticated attacker read, create, delete, or modify all OWSM-accessible data over HTTP. Tagged as an authentication bypass, it affects versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: XML Security component). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.
Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.