This vulnerability affects Oracle Web Services Manager components in Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. It is exploitable remotely without authentication over HTTP, enabling attackers to compromise the system by accessing or modifying critical data. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, with high confidentiality and low integrity impacts, and no availability impact. Oracle's September 2026 Critical Security Patch Update includes fixes for this vulnerability among many others. The vendor strongly recommends applying these patches without delay to prevent exploitation.

Successful exploitation can lead to unauthorized access to all data accessible by Oracle Web Services Manager and unauthorized modification (update, insert, delete) of some of that data. This compromises confidentiality and integrity of the affected system's data. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Oracle has released official security patches for this vulnerability in the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle Web Services Manager versions 12.2.1.4.0 and 14.1.2.0.0 promptly. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to mitigate this vulnerability. Patch status is confirmed by the vendor advisory.