Oracle disclosed CVE-2026-60737, a CVSS 9.1 flaw in Oracle Web Services Manager that lets an unauthenticated attacker reach the product over HTTP and read or alter all data it can access.
What Is It
CVE-2026-60737 is a vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware, specifically the Web Services Security component. Oracle describes it as easily exploitable: an unauthenticated attacker with network access via HTTP can compromise Oracle Web Services Manager without any user interaction.
Successful exploitation results in unauthorized creation, deletion, or modification of critical data, or all data accessible to Oracle Web Services Manager, as well as unauthorized read access to critical data or complete access to all accessible data.
The CVSS 3.1 base score is 9.1 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Exploitability subscore is 3.9, the maximum, with an impact subscore of 5.2. Confidentiality and integrity impacts are High; availability is unaffected.
Why It Matters
The combination here is the worst kind for defenders: network attack vector, low attack complexity, no privileges required, and no user interaction. That is a pre-authentication path to full read and write access over the data plane of a security-enforcement component.
Oracle Web Services Manager is the piece of Fusion Middleware that enforces web services security policy. A component that governs authentication and policy for other services is a high-value pivot, and an attacker with unauthorized modification access to its data is positioned against everything downstream of those policies.
Exploitation status is unverified. We have no citable source establishing either active exploitation or the absence of it, and no remediation deadline has been sourced for this CVE. Defenders should treat the exploitation question as open rather than settled in either direction; a 9.1 unauthenticated Oracle middleware bug is a predictable target, and the lack of a confirmed report is not evidence that exploitation will not follow.
What's Vulnerable
Per Oracle Corporation, the affected supported versions of Oracle Web Services Manager are:
- 12.2.1.4.0
- 14.1.2.0.0
No affected CPE entries were listed in the NVD record at the time of publication.
Patch Status
The CVE was published 2026-08-18 with NVD status Received, meaning the record has not yet completed NVD analysis. Fixed versions and patch availability have not been confirmed against a verified Oracle advisory.
One caution on the reference trail: the Oracle URL carried in the record follows Oracle's Critical Patch Update naming convention for an August 2026 advisory, but Oracle publishes Critical Patch Updates on a fixed quarterly schedule in January, April, July, and October. There is no scheduled August CPU, so the mapping of this CVE to a specific patch bundle should be treated as unconfirmed until Oracle's security alerts page is checked directly. Verify the fix against Oracle's published advisories and My Oracle Support before assuming a patch is available for your version.
Sources
- Oracle Critical Patch Update Advisory (referenced URL, month unverified), https://www.oracle.com/security-alerts/cpuaug2026.html
- NVD, CVE-2026-60737, https://nvd.nist.gov/vuln/detail/CVE-2026-60737