Oracle Access Manager CVE-2026-47037

Exploitation requires network access to Oracle Access Manager over HTTP plus low-privilege credentials (CVSS PR:L), so an attacker must already be able to authenticate at a basic level and this is not a fully unauthenticated attack. The specific vulnerable surface is the Authentication Engine component of OAM version 14.1.2.1.0; environments not running that version, or with OAM authentication endpoints unreachable from the attacker's network, are not exposed. No user interaction is required (UI:N) and attack complexity is low (AC:L), so beyond obtaining a low-privilege account and a network path there are no additional configuration prerequisites stated in the advisory.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) signals a genuinely serious, easily reachable issue: network-facing over HTTP, low attack complexity, no user interaction, and only low privileges required, meaning any authenticated-but-unprivileged foothold suffices to reach full takeover. Oracle's own 'easily exploitable' phrasing reinforces low complexity. However, no EPSS score, KEV entry, POC, or SSVC decision data was provided, so exploitation-probability and automatability signals are absent; the only concrete evidence is Oracle's advisory itself. This is a real patch priority given the sensitivity of an SSO/IAM chokepoint and the low bar to exploit, but claims of active exploitation cannot be made, so treat it as high-priority-to-patch rather than confirmed-in-the-wild. Note the minor conflict: the 'Information Disclosure' tag understates the C:H/I:H/A:H 'takeover' impact, so defenders should weight the CVSS impact metrics over the tag.

An attacker who has obtained any low-privileged OAM account (for example a basic user login or a compromised service credential) sends crafted HTTP requests to the Access Manager Authentication Engine and abuses the flaw to escalate to full control of the OAM instance. Because attack complexity is low and no user interaction is needed, the request sequence is straightforward once network access exists; no public POC is currently identified, so exploitation would require independent development.