CVE-2026-83001: Critical severity Oracle Oracle Access Manager vulnerability
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs high privileges and network access to the Oracle Access Manager Authentication Engine over HTTP. No user interaction is required.
Which deployments are affected?
The affected supported Oracle Access Manager versions are 12.2.1.4.0 and 14.1.2.1.0. The issue is in the Authentication Engine component.
What is the potential impact of successful exploitation?
Successful exploitation can result in takeover of Oracle Access Manager, with high confidentiality, integrity, and availability impact. Because the vulnerability has scope change, attacks may also significantly affect additional products.