CVE-2022-21497

CVE-2022-21497 affects Oracle Web Services Manager (component: Web Services Security) within Oracle Fusion Middleware. Affects 12.2.1.3.0 and 12.2.1.4.0. The vulnerability allows an unauthenticated attacker who can reach the service over HTTP to compromise the product. Exploitation requires human...

CVE-2023-21862

CVE-2023-21862 affects Oracle Web Services Manager (OWSM) within Oracle Fusion Middleware, specifically the XML Security component in version 12.2.1.4.0. The issue stems from insufficient input validation, enabling an unauthenticated attacker with network access via HTTP to compromise OWSM, poten...

CVE-2026-21992

The CVE-2026-21992 vulnerability affects Oracle Fusion Middleware components: Oracle Identity Manager (REST WebServices) and Oracle Web Services Manager (Web Services Security). Affected versions are 12.2.1.4.0 and 14.1.2.1.0. It is exploitable over HTTP without authentication and can lead to tak...

CVE-2026-60737

Oracle Web Services Manager 12.2.1.4.0 and 14.1.2.0.0 (Web Services Security component) is critically vulnerable (CVSS 9.1): an unauthenticated remote attacker can read, create, delete or modify all accessible data. Oracle's August 2026 CPU patch is the official fix. No exploitation details or Po...

CVE-2026-70924

Oracle Web Services Manager's Web Services Security component in versions 12.2.1.4.0 and 14.1.2.0.0 allows an unauthenticated, network-based attacker (via HTTPS) to fully compromise the product. CVSS 3.1 scores this HIGH (8.1) for confidentiality, integrity, and availability. Oracle has released ...

CVE-2026-61001

Oracle's August 2026 Critical Patch Update addresses CVE-2026-61001, a CVSS 9.6 flaw in the Web Services Security component of Fusion Middleware (versions 12.2.1.4.0 and 14.1.2.0.0). A low-privileged attacker can exploit it via HTTP to read, modify, or delete critical data. Oracle has released pa...