EXPOSURES › CVE-2026-61001
CVE-2026-61001
CRITICALA critical unpatched vulnerability in Oracle Web Services Manager allows low-privileged attackers to compromise the system and access all data via HTTP.
Oracle Web Services Manager in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0 contains a critical flaw enabling unauthorized data access and modification. DIB organizations must patch immediately to prevent attackers from exploiting this easily accessible vulnerability, which could lead to significant data breaches and compliance violations.
Shame score — A critical, easily exploitable vulnerability in a widely used enterprise product that allows low-privileged attackers to compromise the system and access all data, indicating a severe lack of timely patching and robust security design.
▸ RECOMMENDED ACTION Critical severity — schedule patching of the affected products.
Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Web Services Manager. While the vulnerability is in Oracle Web Services Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Web Services Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Web Services Manager accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
| PRODUCT | STATUS |
|---|---|
| Aconex for Defense Oracle |
Authorized |
| Federal Managed Cloud Services Oracle |
Authorized |
| Fusion Cloud Oracle |
Authorized |
| Government Cloud - Common Controls Oracle |
Authorized |
| Oracle Cloud Infrastructure-Government Cloud Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) - Moderate Oracle |
In Process |
| Oracle Service Cloud Oracle |
Authorized |
| Oracle Service Cloud (DOD) Oracle |
Authorized |
| Taleo Cloud - U.S. Government Cloud Oracle |
Authorized |