CVE-2022-21497

CVE-2022-21497 affects Oracle Web Services Manager (component: Web Services Security) within Oracle Fusion Middleware. Affects 12.2.1.3.0 and 12.2.1.4.0. The vulnerability allows an unauthenticated attacker who can reach the service over HTTP to compromise the product. Exploitation requires human...

CVE-2023-21862

CVE-2023-21862 affects Oracle Web Services Manager (OWSM) within Oracle Fusion Middleware, specifically the XML Security component in version 12.2.1.4.0. The issue stems from insufficient input validation, enabling an unauthenticated attacker with network access via HTTP to compromise OWSM, poten...

CVE-2026-21992

A critical vulnerability exists in Oracle Identity Manager (REST WebServices component) and Oracle Web Services Manager (Web Services Security component) within Oracle Fusion Middleware. Affected versions include 12.2.1.4.0 and 14.1.2.1.0 (with 14.1.2.1.1.0 also noted). The root cause is insuffic...

CVE-2026-60737

Oracle Web Services Manager 12.2.1.4.0 and 14.1.2.0.0 (Web Services Security component) is critically vulnerable (CVSS 9.1): an unauthenticated remote attacker can read, create, delete or modify all accessible data. Oracle's August 2026 CPU patch is the official fix. No exploitation details or Po...

CVE-2026-61001

Oracle's August 2026 Critical Patch Update addresses CVE-2026-61001, a CVSS 9.6 flaw in the Web Services Security component of Fusion Middleware (versions 12.2.1.4.0 and 14.1.2.0.0). A low-privileged attacker can exploit it via HTTP to read, modify, or delete critical data. Oracle has released pa...

CVE-2026-70924

Oracle Web Services Manager's Web Services Security component in versions 12.2.1.4.0 and 14.1.2.0.0 allows an unauthenticated, network-based attacker (via HTTPS) to fully compromise the product. CVSS 3.1 scores this HIGH (8.1) for confidentiality, integrity, and availability. Oracle has released ...