CVE-2026-35314: High severity Oracle Oracle Access Manager vulnerability
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Web Server Plugin). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Access Manager accessible data as well as unauthorized read access to a subset of Oracle Access Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Access Manager. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to Oracle Access Manager HTTP endpoints (the Web Server Plugin) using firewall/ACL rules so that only trusted management/trusted application IPs can reach them; block direct access from the public Internet.
- Compensating control
Deploy a Web Application Firewall (WAF) or intrusion prevention system in front of the Oracle Access Manager HTTP endpoints and create rules to detect and block exploit attempts targeting the Web Server Plugin.
- Compensating control
Place Oracle Access Manager Web Server Plugin components on an isolated/internal network segment or require VPN access for administrative and application traffic to eliminate direct HTTP exposure.
- Compensating control
Enable HTTP rate-limiting and DoS protection at the network edge (load balancer, WAF, or edge firewall) to mitigate partial denial-of-service attempts against Oracle Access Manager.
- Operational
Increase logging and monitoring of Oracle Access Manager for signs of unauthorized read, update, insert or delete activity; investigate anomalies and follow incident response procedures if compromise is suspected (including credential rotation and recovery actions as appropriate).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35314?
The severity of CVE-2026-35314 is rated as high with a score of 7.3.
How do I fix CVE-2026-35314?
To fix CVE-2026-35314, you should upgrade to the latest patched version of Oracle Access Manager.
What components of Oracle Fusion Middleware are affected by CVE-2026-35314?
CVE-2026-35314 affects the Web Server Plugin component of the Oracle Access Manager.
What versions of Oracle Access Manager are impacted by CVE-2026-35314?
The affected versions of Oracle Access Manager for CVE-2026-35314 are 12.2.1.4.0 and 14.1.2.1.0.
Can CVE-2026-35314 be exploited remotely?
Yes, CVE-2026-35314 can be easily exploited by an unauthenticated attacker with network access via HTTP.