Access Manager vulnerabilities

38 known vulnerabilities in Access Manager from Oracle. 38 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 10.0 Critical severity

  Oracle Access Manager: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-87337Oct 20, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network

• 7.5 High severity

  Oracle Access Manager: Improper Access Control

  CVE-2026-87296Oct 20, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network

• 9.8 Critical severity

  Oracle Access Manager: Improper Authentication

  CVE-2026-87251Oct 20, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network

• 8.7 High severity

  Oracle Access Manager: Improper Authentication

  CVE-2026-83426Oct 20, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with netwo

• 8.5 High severity

  Oracle Access Manager: Improper Access Control

  CVE-2026-83002Sep 15, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows low privileged attacker with networ

• 9.1 Critical severity

  Oracle Access Manager: Improper Access Control

  CVE-2026-83001Sep 15, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network

• 9.6 Critical severity

  Oracle Access Manager: Improper Access Control

  CVE-2026-73962Sep 15, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network

• 8.1 High severity

  Oracle Access Manager: Improper Access Control

  CVE-2026-73958Sep 15, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with netwo

• 9.8 Critical severity

  Oracle Access Manager: Improper Authentication

  CVE-2026-73950Sep 15, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network

• 9.8 Critical severity

  Oracle Access Manager: Improper Authentication

  CVE-2026-73947Sep 15, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network

• 9.1 Critical severity

  Oracle Access Manager: Improper Access Control

  CVE-2026-73946Sep 15, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network

• 9.9 Critical severity

  Oracle Access Manager: Improper Access Control

  CVE-2026-73945Sep 15, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network

• 9.1 Critical severity

  Oracle Access Manager: Improper Authentication

  CVE-2026-73944Sep 15, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network

• 8.6 High severity

  Oracle Access Manager: Improper Access Control

  CVE-2026-73941Sep 15, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network

• 9.8 Critical severity

  Oracle Access Manager: Improper Authentication

  CVE-2026-73940Sep 15, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network

• 8.7 High severity

  Oracle Access Manager: Improper Access Control

  CVE-2026-73926Sep 15, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network

• 9.9 Critical severity

  Oracle Access Manager: Improper Access Control

  CVE-2026-71163Sep 15, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network

• 10.0 Critical severity

  Oracle Access Manager: Improper Authentication

  CVE-2026-71133Sep 15, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network

• 9.8 Critical severity

  Oracle Access Manager: Improper Authentication

  CVE-2026-70905Aug 18, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Agent infrastructure). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network

• 8.8 High severity

  Oracle Access Manager: Improper Access Control

  CVE-2026-60726Aug 18, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network

• 8.0 High severity

  Oracle Access Manager: Improper Authentication

  CVE-2026-61067Jul 21, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with access t

• 9.8 Critical severity

  Oracle Access Manager: Improper Authentication

  CVE-2026-61065Jul 21, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network

• 8.6 High severity

  Oracle Access Manager: Improper Access Control

  CVE-2026-60559Jul 21, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network

• 8.1 High severity

  Oracle Access Manager: Improper Authentication

  CVE-2026-60416Jul 21, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with netwo

• 10.0 Critical severity

  Oracle Access Manager: Improper Access Control

  CVE-2026-60358Jul 21, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network

• 8.6 High severity

  Oracle Access Manager: Missing Authentication for Critical Functionality

  CVE-2026-60356Jul 21, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network

• 9.8 Critical severity

  Oracle Access Manager: Missing Authentication for Critical Functionality

  CVE-2026-60355Jul 21, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network

• 9.9 Critical severity

  Oracle Access Manager: Improper Authentication

  CVE-2026-60333Jul 21, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network

• 9.8 Critical severity

  Oracle Access Manager: Improper Authentication

  CVE-2026-60328Jul 21, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network

• 8.6 High severity

  Oracle Access Manager: Improper Authentication

  CVE-2026-60327Jul 21, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network

• 9.1 Critical severity

  Oracle Access Manager: Improper Authentication

  CVE-2026-60326Jul 21, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network

• 8.0 High severity

  Oracle Access Manager: Improper Access Control

  CVE-2026-60325Jul 21, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with access t

• 8.8 High severity

  Oracle Access Manager: Improper Authentication

  CVE-2026-47037Jul 21, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). The supported version that is affected is 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTT

• 7.3 High severity

  Oracle Access Manager: Improper Access Control

  CVE-2026-35314Jun 17, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Web Server Plugin). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network acc

• 9.9 Critical severity

  Oracle Access Manager: Improper Access Control

  CVE-2026-35313Jun 17, 2026Oracle

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network

• 7.5 High severity

  Access Manager: Missing Authentication for Critical Functionality

  CVE-2022-39412Oct 18, 2022OracleEPSS 2.21%

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Admin Console). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to co

• 7.5 High severity

  Oracle Fusion Middleware Unspecified Exploited

  CVE-2021-35587Jan 19, 2022OracleEPSS 96.3%

  Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with net

• 9.8 Critical severity

  Oracle Multiple Products Remote Code Execution Exploited

  CVE-2020-2555Jan 15, 2020OracleEPSS 97.1%

  Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticat