CVE-2026-70924
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
Vulnerability in Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Affects versions 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Web Services Manager, resulting in takeover.
Risk Assessment
Risk is potential full compromise of the web services manager, potentially affecting security of all dependent services.
Recommendation
Apply Oracle patches and restrict access to HTTPS services.
Other vulnerabilities in Oracle Web Services Manager
See all- CVE-2026-61001Critical
Vulnerability in Oracle Web Services Manager (component: Web Services Security) affects versions 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable flaw allows low privileged attacker with network access via HTTP to perform unauthorized creation, deletion or modification of critical data and unauthorized access to data. Attacks may significantly impact additional products (scope change). CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts).
- CVE-2026-60737Critical
Vulnerability in Oracle Web Services Manager (component: Web Services Security) allows an unauthenticated attacker via HTTP to gain unauthorized access, modification, or deletion of data. The attack can result in full compromise of accessible data. CVSS score 9.1.
- CVE-2026-83334High
Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Affected versions are 12.2.1.4.0 and 14.1.2.0.0. A difficult to exploit vulnerability allows an unauthenticated attacker with network access via SOAP to compromise Oracle Web Services Manager, resulting in unauthorized access to critical data and the ability to cause a hang or frequently repeatable crash (complete DOS).
- CVE-2026-83265High
Vulnerability in Oracle Web Services Manager (Web Services Agent component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can gain unauthorized access to critical data and update, insert or delete some data. CVSS 3.1 Base Score 8.2.
Original NVD description (English source)
Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Web Services Manager. Successful attacks of this vulnerability can result in takeover of Oracle Web Services Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS