What is the CVSS score of CVE-2026-47037?

CVE-2026-47037 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Access Manager are affected by CVE-2026-47037?

Oracle Access Manager 14.1.2.1.0 contains a critical vulnerability (CVE-2026-47037, CVSS 8.8) in its authentication engine enabling complete compromise of the identity and access management platform.

How to fix or mitigate CVE-2026-47037?

Within 24 hours, verify your Oracle Fusion Middleware version and contact Oracle Support for deployment-specific guidance. Within 7 days, restrict HTTP access to Oracle Access Manager to authorized administrators only, deploy Web Application Firewall rules for the authentication engine, and enable enhanced logging to detect exploitation attempts. Within 30 days, monitor Oracle security advisories for patch availability, establish expedited patching procedures when released, and evaluate alternative IAM solutions.

Oracle Access Manager CVE-2026-47037

EUVD-2026-46524 HIGH

Improper Authentication (CWE-287)

2026-07-21 oracle

GHSA-m534-2v87-qqgv

Authentication Bypass Oracle Oracle Access Manager Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network HTTP access with low complexity and no interaction; PR:L reflects the required low-privilege account, and product takeover justifies C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 23:27 vuln.today

CVE Published

Jul 21, 2026 - 21:33 nvd

HIGH 8.8

DescriptionCVE.org

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). The supported version that is affected is 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Access Manager 14.1.2.1.0 (Oracle Fusion Middleware) is possible through its Authentication Engine, allowing a low-privileged attacker with HTTP network access to take over the identity and access management platform. Oracle rates this CVSS 3.1 8.8 with high impact to confidentiality, integrity, and availability, and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Access Manager (OAM) is the web single sign-on and access-control component of Oracle Fusion Middleware, brokering authentication and authorization for downstream enterprise applications and portals. The flaw resides specifically in the Authentication Engine, the subsystem that validates credentials and issues session/SSO tokens, so a defect there can directly undermine every application that trusts OAM for login. Oracle does not assign a CWE for this issue (CWE: N/A), and while the tags list 'Information Disclosure', the CVSS vector's C:H/I:H/A:H and the 'takeover' language point to a full-control weakness rather than mere data leakage. The single affected CPE is cpe:2.3:a:oracle_corporation:oracle_access_manager, confirming the product but not narrowing the internal mechanism.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update, per the advisory at https://www.oracle.com/security-alerts/cpujul2026.html; this is Patch available per vendor advisory, as the input does not specify an exact fixed build number, so consult the CPU patch matrix for the precise patch or bundle covering OAM 14.1.2.1.0. Oracle strongly advises applying CPU patches without delay because it does not offer standalone mitigations for many Fusion Middleware flaws. As compensating controls until patched, restrict network reachability of the OAM authentication endpoints to trusted networks and reverse proxies (accepting that legitimate remote SSO users may be impacted), tighten who holds low-privilege OAM accounts since PR:L is the exploitation prerequisite, and increase monitoring of authentication-engine logs for anomalous session or token activity; none of these substitute for the vendor patch.