CVE-2026-83334

CVE-2026-83334 is a difficult-to-exploit flaw in the Web Services Security component of Oracle Web Services Manager (OWSM), part of Oracle Fusion Middleware. An unauthenticated remote attacker who has network access to the product's SOAP interfaces can send crafted requests that compromise OWSM, resulting in unauthorized read access to critical data or all OWSM-accessible data, plus the ability to cause a hang or frequently repeatable crash (complete denial of service). The vulnerability affects OWSM versions 12.2.1.4.0 and 14.1.2.0.0 and carries a CVSS 3.1 base score of 7.4 (high), driven by confidentiality and availability impacts with no integrity impact. The high attack complexity means exploitation is not trivial, and successful attacks require no privileges or user interaction. There is no known public proof of concept, the flaw is not on the CISA Known Exploited Vulnerabilities list, and no in-the-wild exploitation has been reported; a fix is available through Oracle's Critical Patch Update program.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-83334 to all Oracle Web Services Manager installations running 12.2.1.4.0 or 14.1.2.0.0, prioritizing any OWSM/SOAP endpoints reachable from untrusted networks. Restrict or proxy SOAP and WSM policy endpoints at the network perimeter so they are not directly internet-facing. Monitor OWSM-managed Web services for repeated crashes, hangs, or anomalous unauthenticated SOAP request patterns that could indicate exploitation attempts.