CVE-2026-47037 in Access Manager
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). The supported version that is affected is 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within the Oracle Access Manager authentication engine component of Oracle Fusion Middleware, specifically affecting version 14.1.2.1.0. The authentication engine serves as a critical security control responsible for managing user access and authentication processes within enterprise environments, making it a prime target for attackers seeking to compromise organizational security postures. The vulnerability's classification as easily exploitable indicates that the attack surface is relatively accessible to threat actors with minimal technical sophistication.
The technical flaw manifests as a weakness in the authentication engine's processing of HTTP requests, allowing a low-privileged attacker to execute unauthorized operations against the Oracle Access Manager system. The CVSS 3.1 vector analysis reveals an attack complexity level of low (AC:L) and requires only low privileges (PR:L), indicating that attackers can leverage common network-based exploitation techniques without requiring elevated access rights or specialized tools. The vulnerability's impact spans all three core security principles with high severity scores across confidentiality, integrity, and availability components, suggesting a comprehensive compromise potential.
From an operational perspective, successful exploitation of this vulnerability could result in complete takeover of the Oracle Access Manager system, enabling attackers to assume full administrative control over user authentication services. This would allow adversaries to bypass authentication mechanisms, access protected resources, modify user permissions, and potentially escalate their privileges within the broader enterprise infrastructure. The unauthenticated nature of the attack means that organizations may not detect compromise until after significant damage has occurred, as there are no explicit authentication barriers preventing initial access attempts.
The vulnerability aligns with CWE-287 (Improper Handling of Authentication Factors) and represents a critical weakness in the authentication engine's security architecture. Organizations should consider implementing network segmentation to limit access to Oracle Access Manager systems, deploying intrusion detection systems to monitor for anomalous HTTP traffic patterns, and applying the latest Oracle security patches immediately upon availability. The ATT&CK framework categorizes this vulnerability under privilege escalation and credential access tactics, making it particularly dangerous in environments where Oracle Access Manager serves as a central authentication hub for enterprise-wide access control systems.