CVE-2026-83334
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Affected versions are 12.2.1.4.0 and 14.1.2.0.0. A difficult to exploit vulnerability allows an unauthenticated attacker with network access via SOAP to compromise Oracle Web Services Manager, resulting in unauthorized access to critical data and the ability to cause a hang or frequently repeatable crash (complete DOS).
Risk Assessment
An unauthenticated attacker can access critical data and cause complete denial of service, impacting confidentiality and availability. The CVSS 3.1 base score of 7.4 indicates high risk.
Recommendation
Apply Oracle security updates for versions 12.2.1.4.0 and 14.1.2.0.0 and restrict SOAP network access to trusted sources.
Other vulnerabilities in Oracle Web Services Manager
See all- CVE-2026-61001Critical
Vulnerability in Oracle Web Services Manager (component: Web Services Security) affects versions 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable flaw allows low privileged attacker with network access via HTTP to perform unauthorized creation, deletion or modification of critical data and unauthorized access to data. Attacks may significantly impact additional products (scope change). CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts).
- CVE-2026-60737Critical
Vulnerability in Oracle Web Services Manager (component: Web Services Security) allows an unauthenticated attacker via HTTP to gain unauthorized access, modification, or deletion of data. The attack can result in full compromise of accessible data. CVSS score 9.1.
- CVE-2026-83265High
Vulnerability in Oracle Web Services Manager (Web Services Agent component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can gain unauthorized access to critical data and update, insert or delete some data. CVSS 3.1 Base Score 8.2.
- CVE-2026-70924High
Vulnerability in Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Affects versions 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Web Services Manager, resulting in takeover.
Original NVD description (English source)
Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle Web Services Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Web Services Manager accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Web Services Manager. CVSS 3.1 Base Score 7.4 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS