CVE-2026-60737: Oracle Web Services Manager Auth Bypass

CVE-2026-60737 Overview

CVE-2026-60737 is a critical vulnerability in Oracle Web Services Manager, a component of Oracle Fusion Middleware. The flaw resides in the Web Services Security component and affects supported versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can compromise the product without user interaction. Successful exploitation allows unauthorized creation, deletion, or modification of critical data, along with unauthorized read access to all Oracle Web Services Manager accessible data. Oracle assigned this issue to broken access control [CWE-284].

Critical Impact
Remote, unauthenticated attackers can read, create, modify, or delete all data accessible to Oracle Web Services Manager over HTTP.

Affected Products

Oracle Web Services Manager 12.2.1.4.0
Oracle Web Services Manager 14.1.2.0.0
Oracle Fusion Middleware deployments exposing Web Services Security

Discovery Timeline

2026-08-18 - CVE-2026-60737 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60737

Vulnerability Analysis

The vulnerability affects the Web Services Security component of Oracle Web Services Manager (OWSM). OWSM enforces authentication, authorization, and message-level security policies across Oracle Fusion Middleware SOAP and REST services. A flaw in this security enforcement layer allows attackers to reach protected functionality without valid credentials.

Because OWSM sits in front of business web services, a bypass exposes downstream integrations, policy stores, and configuration data. Oracle classifies the impact as high for confidentiality and integrity, with no availability impact. The EPSS model currently estimates a low near-term exploitation probability, but the network-reachable, unauthenticated attack surface makes this a high-priority patch target.

Root Cause

Oracle's advisory maps the weakness to improper access control [CWE-284] within the Web Services Security handling logic. The component fails to correctly validate authorization on requests it processes, allowing an attacker to reach protected operations without presenting valid WS-Security credentials. Oracle has not released a detailed technical breakdown of the specific code path.

Attack Vector

An unauthenticated remote attacker sends crafted HTTP requests to an internet- or intranet-reachable Oracle Web Services Manager endpoint. No user interaction, privileges, or prior foothold are required. Once the access control check is bypassed, the attacker can read, create, modify, or delete data accessible to OWSM, including policy attachments and security artifacts governing other Fusion Middleware services.

No public proof-of-concept, exploit code, or CISA KEV listing exists at the time of publication. See the Oracle Security Alert for authoritative technical guidance.

Detection Methods for CVE-2026-60737

Indicators of Compromise

Unauthenticated HTTP or HTTPS requests to OWSM endpoints such as /wsm-pm, /wsm/, or policy management URIs returning 200 OK without a preceding authentication exchange.
Unexpected changes to OWSM policy stores, policy attachments, or credential store artifacts.
New or modified WS-Security policies applied to production services outside change-management windows.

Detection Strategies

Correlate WebLogic and OWSM access logs for anonymous requests to policy management URIs, and alert on non-GET methods without authenticated principals.
Baseline normal OWSM administrative activity by source IP and user, then flag deviations, particularly requests originating outside management networks.
Monitor Fusion Middleware audit logs for policy CRUD operations that lack a corresponding authenticated administrative session.

Monitoring Recommendations

Forward WebLogic, OWSM, and Oracle HTTP Server access and audit logs to a centralized analytics platform for retention and correlation.
Enable file integrity monitoring on OWSM configuration directories and policy repositories to detect unauthorized modification.
Track outbound connections from Fusion Middleware hosts to detect data staging or exfiltration following a suspected bypass.

How to Mitigate CVE-2026-60737

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert to all Oracle Web Services Manager 12.2.1.4.0 and 14.1.2.0.0 deployments.
Inventory every Fusion Middleware host running OWSM and confirm patch status against Oracle's advisory.
Restrict network access to OWSM management endpoints so that only trusted administrative networks can reach them.
Rotate credentials, keys, and policy signing material managed by OWSM if compromise is suspected.

Patch Information

Oracle addressed CVE-2026-60737 in the August 2026 Critical Patch Update. Administrators should download the OWSM patches from My Oracle Support and apply them following Oracle's documented Fusion Middleware patching procedure. Review the Oracle Security Alert for version-specific patch identifiers and prerequisites.

Workarounds

Place OWSM behind a reverse proxy or web application firewall that enforces authentication on management URIs until patching completes.
Block external access to policy management and configuration endpoints via network ACLs on load balancers and firewalls.
Disable or restrict any non-essential OWSM listener bindings exposed to untrusted networks.

bash

# Example: restrict OWSM management endpoints at the reverse proxy (nginx)
location ~ ^/(wsm-pm|wsm)/ {
    allow 10.0.0.0/8;      # trusted management subnet
    deny  all;
    proxy_pass http://owsm-backend;
}