Description

Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Web Services Manager. Successful attacks of this vulnerability can result in takeover of Oracle Web Services Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-18T21:17:50.280Z",
  "pubdate": "2026-08-18T21:17:50.280Z",
  "executiveSummary": "A severe vulnerability exists within the Web Services Security component of the Oracle Web Services Manager product, part of Oracle Fusion Middleware. The affected supported versions are 12.2.1.4.0 and 14.1.2.0.0. This security flaw is categorized as difficult to exploit, yet it grants an unauthenticated attacker operating over the network via HTTPS the capability to achieve a complete system compromise.\nSuccessful exploitation of this vulnerability has critical risk implications, leading directly to the full takeover of the Oracle Web Services Manager. The CVSS 3.1 base score is evaluated at 8.1, reflecting high impacts across Confidentiality, Integrity, and Availability. The attack vector is network-based (AV:N), requiring no privileges (PR:N) and no user interaction (UI:N), though exploitation complexity is marked as high (AC:H) with an unchanged security scope (S:U).\nOrganizations utilizing the vulnerable versions of Oracle Fusion Middleware must prioritize defensive measures, as a successful compromise allows adversaries to manipulate secure web services, intercept sensitive credentials or payload data, and disrupt critical business applications managed by the infrastructure.",
  "technicalDetails": "The vulnerability resides in the Web Services Security component of Oracle Web Services Manager within Oracle Fusion Middleware. Specifically, the flaw affects versions 12.2.1.4.0 and 14.1.2.0.0, exposing the endpoint to remote exploitation over the HTTPS protocol.\nThe attack vector is strictly network-based (AV:N), allowing remote threat actors to interact directly with the vulnerable service without prior authentication (PR:N) or the requirement for user interaction (UI:N). Although the vulnerability is classified with a high attack complexity (AC:H)—implying that successful exploitation may require specific timing, race conditions, precise parameter manipulation, or sophisticated payload crafting—the resulting impact is catastrophic.\nThe step-by-step attack flow begins with an unauthenticated adversary establishing an HTTPS connection to the exposed Oracle Web Services Manager interface. The attacker leverages the high-complexity exploitation method to interact with the underlying Web Services Security component, bypassing security controls or subverting cryptographic or authentication enforcement mechanisms. By sending a maliciously crafted payload over the network, the attacker triggers memory corruption, insecure deserialization, or logic flaws within the vulnerable component.\nPost-exploitation impact encompasses a complete takeover of the Oracle Web Services Manager. Because the component handles critical security policies, credentials, and message processing for enterprise web services, an attacker gaining control achieves elevated execution privileges. This grants unauthorized read, write, and execute capabilities over sensitive configuration data, resulting in total loss of Confidentiality, Integrity, and Availability across the affected middleware environment."
}