How to determine if users have the default password in Oracle 12c?
SYS and SYSTEM accounts are incorrectly listed in DBA_USERS_WITH_DEFPWD in 12c (Doc ID 2173962.1)


  SYS and SYSTEM have that flag set a database create time, and the flag
  doesn't clear until the first password change AFTER the database is
  created. So it may or may not be a default password, but it if it
  isn't default, it's one that hasn't been changed since the database
  was created and therefore should be changed.


If you do not have access to this, then:

https://mandysandhu.com/2017/10/20/oracle-12c-syssystem-accounts-are-incorrectly-listed-in-dba_users_with_defpwd/