CVE-2026-47037: High severity Oracle Oracle Access Manager vulnerability

Published Jul 21, 2026

Updated

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). The supported version that is affected is 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Affected Software

2 affected components

Oracle Oracle Access Manager=14.1.2.1.0

Oracle Access Manager=14.1.2.1.0

Event History

Jul 21, 2026

CVE Published

via MITRE·09:33 PM

Data Sourced

via MITRE·09:33 PM

DescriptionSeverity

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-47037?

The severity of CVE-2026-47037 is high with a CVSS score of 8.8.

How do I fix CVE-2026-47037?

To fix CVE-2026-47037, upgrade to the latest version of Oracle Access Manager that is not affected by this vulnerability.

Who is affected by CVE-2026-47037?

CVE-2026-47037 affects users of Oracle Access Manager version 14.1.2.1.0.

What type of attack can exploit CVE-2026-47037?

CVE-2026-47037 can be exploited by a low privileged attacker with network access via HTTP.

What components of Oracle Fusion Middleware are affected by CVE-2026-47037?

CVE-2026-47037 specifically affects the Authentication Engine component of Oracle Access Manager.