CVE-2026-83265

Oracle Web Services Manager (OWSM), a component of Oracle Fusion Middleware, contains an easily exploitable flaw in its Web Services Agent that allows an unauthenticated attacker with network access via HTTP to compromise the product. The vulnerability requires no privileges or user interaction and has low attack complexity, meaning a remote attacker who can reach an OWSM endpoint over HTTP can exploit it directly. A successful attack can result in unauthorized read access to critical data — up to complete access to all OWSM-accessible data — as well as unauthorized update, insert, or delete access to some of that data; availability is not impacted (CVSS 3.1 base score 8.2). Organizations running OWSM versions 12.2.1.4.0 or 14.1.2.0.0 are affected. No public proof of concept exists, the flaw is not on the CISA Known Exploited Vulnerabilities list, and no exploitation in the wild has been reported to date.

What to do: Apply the Oracle Critical Patch Update that remedies this flaw to all OWSM 12.2.1.4.0 and 14.1.2.0.0 installations. Restrict network access so OWSM/Web Services Agent endpoints are not reachable by untrusted networks or anonymous HTTP clients. Review OWSM and WebLogic access logs for unauthenticated HTTP requests to agent endpoints and investigate any unexpected data access or modification.