This vulnerability affects Oracle Web Services Manager, a component of Oracle Fusion Middleware's Web Services Security. It is exploitable remotely over HTTP by an attacker with low privileges, enabling compromise of the product and possibly other Oracle products due to scope change. The attacker can gain unauthorized creation, deletion, or modification access to critical data or all data accessible via Oracle Web Services Manager. The CVSS vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impacts.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle Web Services Manager and potentially other Oracle products. This compromises confidentiality and integrity of sensitive data accessible through the affected product versions. There is no direct impact on availability reported.

Oracle has released security patches addressing this vulnerability as part of their August 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to affected versions 12.2.1.4.0 and 14.1.2.0.0 of Oracle Web Services Manager. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch availability and installation instructions are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html.