CVE-2026-83334

Deferred Deferred - Pending Action

Oracle Web Services Manager SOAP Access Vulnerability

Publication date: 2026-09-15

Last updated on: 2026-09-21

Assigner: Oracle

Description

Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle Web Services Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Web Services Manager accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Web Services Manager. CVSS 3.1 Base Score 7.4 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-21

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-83334

EUVD

EUVD-2026-79687

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	web_services_manager	12.2.1.4.0
oracle	web_services_manager	14.1.2.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Web Services Manager, part of Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker can exploit it remotely via SOAP to gain unauthorized access to critical data or cause a denial of service (DoS) by crashing the system repeatedly.

Detection Guidance

Detection of CVE-2026-83334 requires monitoring for unusual SOAP traffic targeting Oracle Web Services Manager. Check logs for repeated crashes or hangs in the service. Inspect network traffic for unauthenticated SOAP requests to affected versions (12.2.1.4.0, 14.1.2.0.0).

Impact Analysis

If you use the affected Oracle Web Services Manager versions, an attacker could steal sensitive data or disrupt services by causing crashes. This could lead to data breaches, service outages, or loss of system availability.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face compliance violations, fines, or legal consequences if exploited.

Mitigation Strategies

Apply the latest Oracle Critical Patch Update for Oracle Fusion Middleware, specifically for Oracle Web Services Manager versions 12.2.1.4.0 and 14.1.2.0.0. Restrict network access to SOAP interfaces and monitor for unusual activity targeting the affected component.

Hi! I’m here to help you understand CVE-2026-83334. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70