Oracle Web Services Manager vulnerabilities

6 CVEs affecting Oracle Web Services Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-70924, published 2026-08-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-21497, published 2022-04-19. High severity, CVSS 8.1. EPSS: 1.7% chance of exploitation in the next 30 days. Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily…
CVE-2026-21992, published 2026-03-20. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices) and Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web…
CVE-2023-21862, published 2023-01-18. High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days. Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: XML Security component). The supported version that is affected is 12.2.1.4.0. Easily exploitable…
CVE-2026-60737, published 2026-08-18. Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily…
CVE-2026-70924, published 2026-08-18. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0.…
CVE-2026-61001, published 2026-08-18. Critical severity, CVSS 9.6. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily…