CVE-2026-46812: Medium severity Oracle Oracle Access Manager vulnerability
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Access Manager accessible data as well as unauthorized read access to a subset of Oracle Access Manager accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable or block unauthenticated HTTP access to Oracle Access Manager instances. If HTTP is required, restrict it to authenticated channels or internal networks only; prefer removing public HTTP listeners for the product.
Oracle Access Manager (Authentication Engine) HTTP access = disabled or restricted - Compensating control
Restrict network access to Oracle Access Manager HTTP endpoints at the network perimeter and internal firewalls/WAFs to only trusted IP ranges and management networks. Apply WAF rules to inspect and block suspicious HTTP requests.
- Operational
Inventory and identify all Oracle Access Manager deployments running the affected versions 12.2.1.4.0 and 14.1.2.1.0 and prioritize remediation or isolation of those instances until a vendor fix is available.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46812?
The severity of CVE-2026-46812 is medium, with a score of 6.1.
How do I fix CVE-2026-46812?
To fix CVE-2026-46812, update Oracle Access Manager to the latest supported version provided by Oracle.
What component of Oracle Fusion Middleware is affected by CVE-2026-46812?
CVE-2026-46812 affects the Authentication Engine component of Oracle Access Manager.
Which versions of Oracle Access Manager are impacted by CVE-2026-46812?
The affected versions of Oracle Access Manager are 12.2.1.4.0 and 14.1.2.1.0.
Can an attacker exploit CVE-2026-46812 without authentication?
Yes, CVE-2026-46812 can be exploited by an unauthenticated attacker with network access via HTTP.