CVE-2026-61001
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Vulnerability in Oracle Web Services Manager (component: Web Services Security) affects versions 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable flaw allows low privileged attacker with network access via HTTP to perform unauthorized creation, deletion or modification of critical data and unauthorized access to data. Attacks may significantly impact additional products (scope change). CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts).
Risk Assessment
The risk for the organization includes potential compromise of data integrity and confidentiality in Web Services Manager and potential impact on other systems, potentially leading to broader compromise.
Recommendation
Apply Oracle patches urgently and monitor HTTP traffic to Web Services Manager to detect unauthorized activities.
Other vulnerabilities in Oracle Web Services Manager
See all- CVE-2026-60737Critical
Vulnerability in Oracle Web Services Manager (component: Web Services Security) allows an unauthenticated attacker via HTTP to gain unauthorized access, modification, or deletion of data. The attack can result in full compromise of accessible data. CVSS score 9.1.
- CVE-2026-83334High
Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Affected versions are 12.2.1.4.0 and 14.1.2.0.0. A difficult to exploit vulnerability allows an unauthenticated attacker with network access via SOAP to compromise Oracle Web Services Manager, resulting in unauthorized access to critical data and the ability to cause a hang or frequently repeatable crash (complete DOS).
- CVE-2026-83265High
Vulnerability in Oracle Web Services Manager (Web Services Agent component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can gain unauthorized access to critical data and update, insert or delete some data. CVSS 3.1 Base Score 8.2.
- CVE-2026-70924High
Vulnerability in Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Affects versions 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Web Services Manager, resulting in takeover.
Original NVD description (English source)
Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Web Services Manager. While the vulnerability is in Oracle Web Services Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Web Services Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Web Services Manager accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS