CVE-2026-61001: Oracle Web Services Manager Auth Bypass

CVE-2026-61001 Overview

CVE-2026-61001 is a critical vulnerability in Oracle Web Services Manager, a component of Oracle Fusion Middleware. The flaw resides in the Web Services Security component and affects versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access over HTTP can exploit the issue to compromise Oracle Web Services Manager. The vulnerability produces a scope change, meaning successful exploitation can impact additional products beyond Web Services Manager itself. Attackers can gain unauthorized read access to all accessible data and create, delete, or modify critical data. Oracle addressed the vulnerability in the August 2026 Critical Patch Update.

Critical Impact
Low-privileged network attackers can compromise Oracle Web Services Manager, causing scope-changing impact to confidentiality and integrity across dependent Fusion Middleware components.

Affected Products

Oracle Web Services Manager 12.2.1.4.0
Oracle Web Services Manager 14.1.2.0.0
Oracle Fusion Middleware deployments that rely on Oracle Web Services Manager for Web Services Security

Discovery Timeline

2026-08-18 - CVE-2026-61001 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-61001

Vulnerability Analysis

The vulnerability affects the Web Services Security component of Oracle Web Services Manager (OWSM). OWSM enforces authentication, authorization, and message-level protection policies for SOAP and REST services within Oracle Fusion Middleware. An attacker with a low-privileged account and network reachability to the OWSM HTTP interface can send crafted requests that bypass intended security controls. The scope change flag in the CVSS vector indicates the vulnerable component and the impacted component differ. Exploitation therefore reaches downstream services that rely on OWSM policy enforcement, extending the blast radius beyond OWSM itself. Successful attacks yield full read access to OWSM-accessible data and the ability to create, delete, or modify critical records. Availability is not impacted according to the published vector.

Root Cause

Oracle has not published the underlying CWE and classifies the weakness as NVD-CWE-noinfo. Based on the advisory, the flaw resides in how OWSM validates or processes web services security requests, allowing an authenticated actor to reach protected functionality. Refer to the Oracle Security Alert for authoritative technical context.

Attack Vector

The attack vector is network-based over HTTP. The attacker requires low privileges and no user interaction. Because the attack complexity is low and the vulnerability produces a scope change, an authenticated adversary on the same network path as an OWSM endpoint can compromise data and policy enforcement across integrated services. No public proof-of-concept exploit is currently available, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is available. See the Oracle Security Alert for vendor-provided technical details.

Detection Methods for CVE-2026-61001

Indicators of Compromise

Unexpected HTTP requests to OWSM policy enforcement endpoints originating from low-privileged service accounts.
Unauthorized creation, modification, or deletion of Web Services Security policies, keystores, or credential store entries.
Anomalous SOAP or REST traffic patterns targeting Oracle Fusion Middleware services that consume OWSM policies.

Detection Strategies

Audit OWSM policy manager logs for administrative operations executed by non-administrative principals.
Correlate WebLogic server access logs with OWSM audit events to identify scope-crossing activity between OWSM and downstream services.
Monitor Fusion Middleware Enterprise Manager for unexpected policy attachments or detachments.

Monitoring Recommendations

Forward OWSM, WebLogic, and Fusion Middleware audit logs to a centralized SIEM for correlation and retention.
Alert on authentication failures followed by successful privileged actions against /wsm-pm and related OWSM URIs.
Baseline normal service-account behavior and flag deviations targeting the Web Services Security component.

How to Mitigate CVE-2026-61001

Immediate Actions Required

Apply the fixes in the Oracle August 2026 Critical Patch Update to all affected Oracle Web Services Manager deployments.
Inventory Fusion Middleware environments to identify all 12.2.1.4.0 and 14.1.2.0.0 OWSM instances.
Rotate credentials used by service accounts that interact with OWSM if compromise is suspected.
Restrict network access to OWSM management interfaces to trusted administrative networks.

Patch Information

Oracle released the fix as part of the August 2026 Critical Patch Update. Review the Oracle Security Alert for patch identifiers, download locations, and prerequisite bundle patches. Apply patches in a validated non-production environment before promoting to production Fusion Middleware domains.

Workarounds

Limit HTTP exposure of OWSM policy manager endpoints to internal, authenticated administrative segments only.
Enforce least privilege for accounts that can authenticate to OWSM and audit membership of OWSM administrative roles.
Enable and review OWSM audit policies to capture policy-change operations until patching is complete.

bash

# Configuration example: restrict access to OWSM policy manager via WebLogic network filters
# Replace <admin_subnet> with your administrative CIDR
connectionfilter.rules=\
  <admin_subnet> * * allow t3 t3s http https,\
  0.0.0.0/0 * * deny t3 t3s http https