Oracle Web Services Manager — CVE-2026-61001 (Critical)

Date Aug 18, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product Oracle · Web Services Manager

CVE CVE-2026-61001

Critical vendor advisory CVE-2026-61001

Summary

Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Web Services Manager. While the vulnerability is in Oracle Web Services Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle W

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.6) in Oracle Web Services Manager. Patch or mitigate promptly. EPSS percentile: 31%.

Operator check

Review CVE-2026-61001 in your asset inventory. Apply patches per vendor guidance and verify Web Services Manager is not exposed. CVSS score: 9.6. EPSS probability: 0.4%; percentile: 31%.

Sources

NVD — CVE-2026-61001 Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed