Oracle Access Manager Auth Engine 14.1.2.1.0: Low-Priv Remote Comp
CVE-2026-47037 Published on July 21, 2026
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). The supported version that is affected is 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability Analysis
CVE-2026-47037 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
What is an authentification Vulnerability?
When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.
CVE-2026-47037 has been classified to as an authentification vulnerability or weakness.
Products Associated with CVE-2026-47037
stack.watch emails you whenever new vulnerabilities are published in Oracle Access Manager or Oracle. Just hit a watch button to start following.
Affected Versions
Oracle Corporation Oracle Access Manager Version 14.1.2.1.0 is affected by CVE-2026-47037Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.