CVE-2026-83002
HighCVSS 8.5Summary
Vulnerability in Oracle Access Manager (Authentication Engine component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with network access via HTTP can exploit it, though it is difficult. This can lead to takeover of Oracle Access Manager and impact additional products (scope change).
Risk Assessment
High risk of takeover of Oracle Access Manager, potentially compromising authentication mechanisms and impacting other systems. Confidentiality, integrity, and availability impacts are high.
Recommendation
Apply Oracle updates for versions 12.2.1.4.0 and 14.1.2.1.0. Restrict network access via HTTP and monitor for unusual authentication attempts.
Other vulnerabilities in Oracle Access Manager
See all- CVE-2026-83369Low
Vulnerability in Oracle Access Manager (component: Access SDK) affects versions 12.2.1.4.0 and 14.1.2.1.0. It is difficult to exploit but allows a low-privileged attacker with network access via HTTP to cause a partial denial of service (partial DoS) of the service.
- CVE-2026-73958High
Vulnerability in Oracle Access Manager (Authentication Engine component). Difficult to exploit, but an unauthenticated attacker with network access via HTTP can compromise the system. High impact on confidentiality, integrity, and availability.
- CVE-2026-73941High
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Affected versions are 12.2.1.4.0 and 14.1.2.1.0. An easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.
- CVE-2026-73926High
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Affected versions are 12.2.1.4.0 and 14.1.2.1.0. An easily exploitable vulnerability allows a high privileged attacker with network access via HTTP to compromise Oracle Access Manager.
- CVE-2015-2593High
Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.2.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Configuration Service.
- CVE-2015-0461High
Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.1.5 and 11.1.1.7 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Authentication Engine.
- CVE-2026-83001Critical
Vulnerability in Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Affects versions 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable, allows high privileged attacker via HTTP to take over the product, with impact on other products (scope change). CVSS 9.1.
- CVE-2026-73962Critical
Vulnerability in Oracle Access Manager (Authentication Engine component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with network access via HTTPS can easily exploit it, potentially impacting additional products (scope change). It results in unauthorized access, creation, deletion, or modification of critical data. CVSS 3.1 Base Score: 9.6.
- CVE-2026-73950Critical
Vulnerability in Oracle Access Manager (Authentication Engine component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via HTTP can easily exploit it to take over Oracle Access Manager. CVSS 3.1 Base Score: 9.8.
- CVE-2026-73947Critical
Vulnerability in Oracle Access Manager (Authentication Engine component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can easily exploit it to take over Oracle Access Manager. CVSS 3.1 Base Score: 9.8.
Original NVD description (English source)
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).