CVE-2026-47037
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
Vulnerability in Oracle Fusion Middleware's Oracle Access Manager product (component: Authentication Engine). Affected version is 14.1.2.1.0. An easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to compromise Oracle Access Manager.
Risk Assessment
Successful attack can lead to full takeover of the access management system, resulting in loss of confidentiality, integrity, and availability of authentication data.
Recommendation
Apply the security patch provided by Oracle for version 14.1.2.1.0. Restrict network access to the HTTP interface to trusted users only.
Other vulnerabilities in Oracle Access Manager
See all- CVE-2015-2593High
Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.2.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Configuration Service.
- CVE-2015-0461High
Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.1.5 and 11.1.1.7 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Authentication Engine.
- CVE-2026-70905Critical
Vulnerability in Oracle Access Manager (component: Agent infrastructure) allows an unauthenticated attacker with network access via SAML to compromise the system. The attack is easily exploitable and requires no user interaction.
- CVE-2026-61065Critical
In Oracle Access Manager (component: Authentication Engine), a vulnerability can be exploited by an unauthenticated attacker over the network via HTTP. Successful attack can lead to complete takeover of Oracle Access Manager.
- CVE-2026-60358Critical
Critical vulnerability in Oracle Access Manager (Authentication Engine component) allows an unauthenticated attacker to remotely take over the server via network using HTTP. The attack may impact additional products (scope change).
- CVE-2026-60355Critical
Critical vulnerability in Oracle Access Manager (Authentication Engine component) allows an unauthenticated attacker to remotely take over the server via network using HTTP. The attack does not impact other products (no scope change).
- CVE-2026-60333Critical
Vulnerability in Oracle Access Manager (Authentication Engine component) allows a low-privileged attacker to remotely take over the system via HTTP. The attack may impact additional products (scope change).
- CVE-2026-60328Critical
Vulnerability in Oracle Access Manager (Authentication Engine component) allows an unauthenticated attacker with network access via HTTP to take over the system.
- CVE-2026-60326Critical
Vulnerability in Oracle Access Manager (component: Authentication Engine) allows unauthenticated attacker via HTTP to gain unauthorized access to critical data and modify it. CVSS 9.1.
- CVE-2026-71124Medium
Vulnerability in Oracle Access Manager (Authorization Engine) affects versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker can cause a partial denial of service via network (TCP).
Original NVD description (English source)
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). The supported version that is affected is 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).