CVE-2026-83265
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Vulnerability in Oracle Web Services Manager (Web Services Agent component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can gain unauthorized access to critical data and update, insert or delete some data. CVSS 3.1 Base Score 8.2.
Risk Assessment
Possible breach of confidentiality and integrity of data processed by web services, potentially leading to unauthorized changes in systems. High risk due to no required authentication.
Recommendation
Apply Oracle security updates for Oracle Web Services Manager versions 12.2.1.4.0 and 14.1.2.0.0 and restrict network access to the Web Services Agent component.
Other vulnerabilities in Oracle Web Services Manager
See all- CVE-2026-61001Critical
Vulnerability in Oracle Web Services Manager (component: Web Services Security) affects versions 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable flaw allows low privileged attacker with network access via HTTP to perform unauthorized creation, deletion or modification of critical data and unauthorized access to data. Attacks may significantly impact additional products (scope change). CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts).
- CVE-2026-60737Critical
Vulnerability in Oracle Web Services Manager (component: Web Services Security) allows an unauthenticated attacker via HTTP to gain unauthorized access, modification, or deletion of data. The attack can result in full compromise of accessible data. CVSS score 9.1.
- CVE-2026-83334High
Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Affected versions are 12.2.1.4.0 and 14.1.2.0.0. A difficult to exploit vulnerability allows an unauthenticated attacker with network access via SOAP to compromise Oracle Web Services Manager, resulting in unauthorized access to critical data and the ability to cause a hang or frequently repeatable crash (complete DOS).
- CVE-2026-70924High
Vulnerability in Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Affects versions 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Web Services Manager, resulting in takeover.
Original NVD description (English source)
Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Agent). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Web Services Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Web Services Manager accessible data as well as unauthorized update, insert or delete access to some of Oracle Web Services Manager accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS