CVE-2020-2555

CVE-2020-2555 (WebLogic/Coherence) : A deserialization vulnerability in Oracle Coherence (Fusion Middleware) enables unauthenticated remote code execution via the T3 protocol. Affected versions include Coherence 3.7.1.x, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0. The flaw originates from ReflectionExtra...

CVE-2021-35587

CVE-2021-35587 affects Oracle Access Manager (OpenSSO Agent) in Oracle Fusion Middleware. Affected versions: 11.1.2.3.0, 12.2.1.3.0, 12.2.1.4.0. The root cause is unauthenticated deserialization of untrusted data, enabling remote code execution and takeover of Oracle Access Manager. The connected...

CVE-2021-29425

CVE-2021-29425 affects Apache Commons IO up to version 2.6, specifically FileNameUtils.normalize. With inputs such as "//../foo" or "\..\foo", normalization can yield a value that does not escape to higher directories, potentially enabling access to the parent directory if the resulting path is u...

CVE-2019-10219

The CVE-2019-10219 entry affects Hibernate Validator: SafeHtml validator annotation fails to sanitize HTML comments/instructions, enabling XSS in affected code paths. Affected CP4S versions are 1.7.2.0, 1.8.0.0, and 1.8.1.0. Remediation is to upgrade to Cloud Pak for Security 1.9.0.0 per IBM guid...

CVE-2026-60358

CVE-2026-60358 affects Oracle Fusion Middleware — Oracle Access Manager (Authentication Engine). Affected supported versions: 12.2.1.4.0 and 14.1.2.1.0. The CVSS v3.1 base score is 10.0 (CRITICAL) with network access, no authentication, and no user interaction required. Exploitation would allow t...

CVE-2018-2587

CVE-2018-2587 affects Oracle Fusion Middleware — Oracle Access Manager, Web Server Plugin. Affected versions: 10.1.4.3.0, 11.1.2.3.0, 12.2.1.3.0. An unauthenticated, network-based attacker can access via HTTP, leading to unauthorized creation, deletion or modification of data, and unauthorized re...

CVE-2022-39412

The CVE-2022-39412 entry affects Oracle Fusion Middleware’s Oracle Access Manager (Admin Console) with the affected version 12.2.1.4.0 . The vulnerability allows an unauthenticated, network-accessible attacker over HTTP to compromise Oracle Access Manager, potentially exposing or gaining complete...

CVE-2023-21859

The CVE-2023-21859 entry concerns Oracle Access Manager (Authentication Engine) in Oracle Fusion Middleware. Affected version: 12.2.1.4.0. Root cause described as insufficient input validation in the Authentication Engine, enabling a high-privilege attacker with logon on the infrastructure to com...

CVE-2021-2358

CVE-2021-2358 affects Oracle Fusion Middleware Oracle Access Manager (Rest interfaces for Access Mgr), with affected version 11.1.2.3.0. Post-authentication impact: a high-privilege attacker who can reach Oracle Access Manager over HTTPS can gain unauthorized access to confidential data or data a...

CVE-2018-2739

CVE-2018-2739 affects Oracle Access Manager (Fusion Middleware) Web Server Plugin. Affected are 10.1.4.3.0, 11.1.2.3.0, and 12.2.1.3.0. The vulnerability enables unauthenticated, network-accessible access via HTTP to compromise Oracle APM, with attacks requiring user interaction. Impact can inclu...

CVE-2018-2879

The CVE-2018-2879 issue affects Oracle Access Manager (part of Oracle Fusion Middleware) specifically the Authentication Engine in versions 11.1.2.3.0 and 12.2.1.3.0. The root cause is a vulnerability that enables unauthenticated attackers with network access over HTTP to compromise Oracle Access...

CVE-2022-39405

CVE-2022-39405 affects Oracle Fusion Middleware’s Oracle Access Manager (Authentication Engine) version 12.2.1.3.0. The vulnerability allows an unauthenticated attacker over HTTP to modify accessible Oracle Access Manager data (impact: data integrity). The connection documents confirm the affecte...

CVE-2017-10262

CVE-2017-10262 affects Oracle Fusion Middleware’s Oracle Access Manager Web Server Plugin (component in 11.1.2.3.0). The vulnerability allows an unauthenticated attacker with network access via HTTPS to compromise Oracle Access Manager, potentially leading to unauthorized access to data across Or...

CVE-2020-2740

CVE-2020-2740 affects Oracle Fusion Middleware’s Oracle Access Manager, specifically the Authentication Engine. Affected versions are 11.1.2.3.0 and 12.2.1.3.0. The vulnerability allows a low-privileged, network-accessible attacker (via HTTP) to compromise data, with the attack requiring user int...

CVE-2020-2747

CVE-2020-2747 affects Oracle Access Manager (SSO Engine) in Oracle Fusion Middleware. A remote attacker with network access over HTTP and low privileges can exploit the flaw to update/insert/delete data or read restricted Oracle Access Manager data on affected versions 11.1.2.3.0 and 12.2.1.3.0; ...

CVE-2020-2745

CVE-2020-2745 affects Oracle Access Manager (Oracle Fusion Middleware, Federation component). Affected versions are 11.1.2.3.0 and 12.2.1.3.0. It is an unauthenticated, network-accessible vulnerability over HTTP that, per the description, can lead to a partial denial of service of Oracle Access M...

CVE-2026-35261

Technical details for CVE-2026-35261 are not publicly available in the provided documents. Monitor Oracle security alerts and CVE records for updates.

CVE-2026-70905

CVE-2026-70905 is a critical vulnerability in the Agent infrastructure component of Oracle Access Manager (Oracle Fusion Middleware), affecting versions 12.2.1.4.0 and 14.1.2.1.0 . An unauthenticated attacker with network access via SAML can achieve full takeover of the product, resulting in high...

CVE-2017-10154

The CVE-2017-10154 vulnerability affects Oracle Fusion Middleware’s Oracle Access Manager (Web Server Plugin) in version 11.1.2.3.0. The issue allows an unauthenticated, network-accessible attacker (via HTTP) to read a subset of data due to a flaw in the Web Server Plugin, with CVSSv3.0 base scor...

CVE-2026-71133

Oracle Access Manager (Oracle Fusion Middleware), specifically the Authentication Engine component, is affected by a critical vulnerability (CVSS 3.1: 10.0 ) in versions 12.2.1.4.0 and 14.1.2.1.0 . An unauthenticated attacker with network access via HTTP can compromise the product with low comple...

CVE-2026-35313

Technical details for CVE-2026-35313 are not provided in the supplied documents. No information on affected products, components, vulnerable versions, or fixes is available here. Monitor for updates from official sources (e.g., Oracle security alerts).

CVE-2026-60355

The CVE-2026-60355 entry concerns Oracle Access Manager within Oracle Fusion Middleware (Authentication Engine). Affected supported versions are 12.2.1.4.0 and 14.1.2.1.0. The vulnerability is exploitable by an unauthenticated, network-accessible attacker over HTTP, with the potential to take ove...

CVE-2026-46812

Technical details are not publicly available in the provided documents. Monitor for updates from Oracle security alerts and CVE records to obtain affected products, vulnerable components, impact, and remediation.

CVE-2026-60726

CVE-2026-60726 affects the Authentication Engine component of Oracle Access Manager (Oracle Fusion Middleware), versions 12.2.1.4.0 and 14.1.2.1.0 . A low-privileged attacker with network access via HTTP can exploit this vulnerability to achieve full takeover of the product, resulting in high imp...

CVE-2026-73940

Oracle Access Manager (Oracle Fusion Middleware) is vulnerable in its Authentication Engine component, affecting versions 12.2.1.4.0 and 14.1.2.1.0 . An unauthenticated attacker with network access via T3 or IIOP can exploit this easily exploitable vulnerability to achieve full takeover of the pr...

CVE-2026-35314

Technical details are not publicly available in the provided documents. Monitor for updates on CVE-2026-35314.

CVE-2026-60328

Summary : CVE-2026-60328 affects Oracle Access Manager, part of Oracle Fusion Middleware, specifically the Authentication Engine. Affected supported versions are 12.2.1.4.0 and 14.1.2.1.0. The vulnerability is described as easily exploitable with network access over HTTP by an unauthenticated att...

CVE-2026-60416

The CVE-2026-60416 affects Oracle Access Manager (Authentication Engine) within Oracle Fusion Middleware. Affected versions are 12.2.1.4.0 and 14.1.2.1.0. The vulnerability allows unauthenticated, network-accessible attackers via HTTP to compromise Oracle Access Manager, with potential takeover a...

CVE-2026-60326

CVE-2026-60326 affects Oracle Access Manager (Authentication Engine) in Oracle Fusion Middleware. Affected versions: 12.2.1.4.0 and 14.1.2.1.0. The vulnerability enables unauthenticated, network-based access via HTTP to compromise OAM, potentially allowing unauthorized creation, deletion, or modi...

CVE-2026-60327

CVE-2026-60327 affects Oracle Access Manager (Authentication Engine) within Oracle Fusion Middleware. Affects 12.2.1.4.0 and 14.1.2.1.0; the issue allows unauthenticated, network-accessible HTTP compromise of Oracle Access Manager, potentially granting unauthorized access to data. The vulnerabili...

CVE-2026-73950

Oracle Access Manager (part of Oracle Fusion Middleware), specifically the Authentication Engine component, is affected by an easily exploitable vulnerability in supported versions 12.2.1.4.0 and 14.1.2.1.0 . An unauthenticated attacker with network access via HTTP can exploit this flaw to achiev...

CVE-2026-61065

CVE-2026-61065 affects Oracle Access Manager (Oracle Fusion Middleware), specifically the Authentication Engine. Affected versions are 12.2.1.4.0 and 14.1.2.1.0. The entry describes an easily exploitable vulnerability that allows an unauthenticated attacker with network access via HTTP to comprom...

CVE-2026-60559

CVE-2026-60559 affects Oracle Access Manager (Authentication Engine) in Oracle Fusion Middleware. Affected versions are 12.2.1.4.0 and 14.1.2.1.0. The vulnerability is exploitable over HTTP without authentication and can lead to unauthorized access to data or full access to Oracle Access Manager ...

CVE-2026-73945

CVE-2026-73945 affects the Authentication Engine component of Oracle Access Manager (Oracle Fusion Middleware), versions 12.2.1.4.0 and 14.1.2.1.0 . A low-privileged attacker with network access via HTTP can exploit this vulnerability to achieve takeover of Oracle Access Manager. The vulnerabilit...

CVE-2026-60356

CVE-2026-60356 affects Oracle Access Manager (Authentication Engine) in Oracle Fusion Middleware. Affected versions are 12.2.1.4.0 and 14.1.2.1.0. The vulnerability is exploitable remotely over HTTP by an unauthenticated attacker, with impact described as unauthorized access to data or complete a...

CVE-2026-73946

CVE-2026-73946 affects the Authentication Engine component of Oracle Access Manager (Oracle Fusion Middleware), versions 12.2.1.4.0 and 14.1.2.1.0 . A high-privileged attacker with network access via HTTP can exploit this with low complexity and no user interaction, resulting in full takeover of ...

CVE-2026-60146

CVE-2026-60146 affects Oracle Fusion Middleware’s Oracle Access Manager (Authentication Engine). Affected versions are 12.2.1.4.0 and 14.1.2.1.0. The vulnerability allows unauthenticated access over HTTP with network access to compromise Oracle Access Manager; exploitation requires user interacti...

CVE-2026-60325

CVE-2026-60325 is a vulnerability in the Oracle Access Manager (Authentication Engine) component of Oracle Fusion Middleware. Affected versions are 12.2.1.4.0 and 14.1.2.1.0. The vulnerability enables a low-privilege attacker with access to the hardware communication segment to compromise Oracle ...

CVE-2026-71163

Oracle Access Manager (component: Authentication Engine ) in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0 is affected by a Critical vulnerability (CVSS 3.1 score 9.9 ). A low-privileged attacker with network access via HTTP can exploit it to gain unauthorized creation, deletion, mo...

CVE-2026-61067

Vulnerability CVE-2026-61067 affects Oracle Access Manager (Oracle Fusion Middleware), component Authentication Engine, with affected versions 12.2.1.4.0 and 14.1.2.1.0. The NVD/Oracle notice indicates an easily exploitable issue where a low-privilege attacker with access to the physical segment ...

CVE-2026-71124

Affected component is the Authorization Engine in Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker over TCP can trigger partial denial of service (CVSS 4.3, MEDIUM). Oracle's August 2026 security alert (cspuaug2026.html) is the primary reference; no patch versio...

CVE-2026-47037

CVE-2026-47037 affects Oracle Access Manager, a component of Oracle Fusion Middleware. The vulnerability is in the Authentication Engine for the affected product version 14.1.2.1.0 and is exploitable remotely over HTTP with low privileges, with potential for takeover of Oracle Access Manager as d...

CVE-2026-60333

CVE-2026-60333 affects Oracle Fusion Middleware’s Oracle Access Manager (Authentication Engine). Affected versions are 12.2.1.4.0 and 14.1.2.1.0. The vulnerability permits a low-privilege attacker with network access over HTTP to compromise Oracle Access Manager, with potential impact on related ...

CVE-2026-73941

Oracle Access Manager (part of Oracle Fusion Middleware), specifically the Authentication Engine component, is affected in supported versions 12.2.1.4.0 and 14.1.2.1.0 . An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain unauthorized access to critical...

CVE-2026-83001

A vulnerability in the Authentication Engine component of Oracle Access Manager (part of Oracle Fusion Middleware) affects supported versions 12.2.1.4.0 and 14.1.2.1.0 . The flaw is reachable over HTTP by a high-privileged network attacker with low complexity and no user interaction. Successful e...

CVE-2026-83002

Oracle Access Manager (component: Authentication Engine ) in Oracle Fusion Middleware is affected in versions 12.2.1.4.0 and 14.1.2.1.0 . A low-privileged attacker with network access via HTTP can exploit this difficult-to-exploit vulnerability to achieve a takeover of Oracle Access Manager. The ...

CVE-2026-60342

The CVE-2026-60342 issue affects Oracle Access Manager (Authentication Engine) in Oracle Fusion Middleware, with affected versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated remote attacker with network access via HTTP can read a subset of Oracle Access Manager data. Publicly provided connecte...

CVE-2026-73926

CVE-2026-73926 affects the Authentication Engine component of Oracle Access Manager (Oracle Fusion Middleware), versions 12.2.1.4.0 and 14.1.2.1.0 . A high-privileged attacker with network access via HTTP can exploit this vulnerability to achieve unauthorized creation, deletion, modification, and...

CVE-2026-73944

Oracle Access Manager (Oracle Fusion Middleware, component: Authentication Engine ) versions 12.2.1.4.0 and 14.1.2.1.0 are affected by a critical vulnerability (CVSS 3.1 base score 9.1 ). An unauthenticated attacker with network access via HTTP can create, delete, or modify data and gain complete...

CVE-2026-83369

Oracle Access Manager (Oracle Fusion Middleware), specifically the Access SDK component, is vulnerable in supported versions 12.2.1.4.0 and 14.1.2.1.0 . A low-privileged attacker with network access via HTTP can trigger a partial denial of service (partial DoS), with no impact to confidentiality ...