Skip to main content

Access Manager CVE-2026-83002

| EUVDEUVD-2026-79330 HIGH
Improper Access Control (CWE-284)
2026-09-15 secalert_us@oracle.com GHSA-pq8g-pqh9-8899
Authentication Bypass Oracle Access Manager
8.5
CVSS 3.1 · Vendor: oracle
View

Vulnerability Assessment

Weakness
CWE
CWE-284
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK

1 technique across 1 tactic: Defense Evasion

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 15, 2026

Full takeover of Oracle Access Manager is achievable by a low-privileged, network-positioned attacker who can reach the product's HTTP Authentication Engine, affecting supported versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware. The flaw requires valid low-privilege credentials (PR:L) and is rated hard to exploit (AC:H), but its scope-change rating means a successful attack against OAM can cascade into the downstream applications that rely on it for single sign-on. As of analysis, no public exploit code and no CISA KEV listing were identified, and the input contained no EPSS score, so real-world exploitation pressure is unquantified despite the 8.5 base score.

Affected VersionsENISA

Oracle Access Manager 14.1.2.1.0
Oracle Access Manager 12.2.1.4.0

Affected Packages

euvd oracle_access_manager no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Access Manager gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 8.5 HIGH
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).

Threat Intelligence Overview

EPSS Score
0.4%
Top 69% exploitable
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.4%
Patch available No
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

42
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +42
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

More in Access Manager

View all
CVE-2020-2555 CRITICAL POC
9.8 Jan 15

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Ra
CVE-2026-71133 CRITICAL
10.0 Sep 15

Authentication bypass in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 lets an unauthenticated remote attacker with HT
CVE-2018-10197 CRITICAL POC
9.8 Jul 11

There is a time-based blind SQL injection vulnerability in the Access Manager component before 9.18.040 and 10.x before

CVE-2018-2879 CRITICAL POC
9.0 Apr 19

Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Authentication Engine).

CVE-2021-29425 MEDIUM POC
4.8 Apr 13

In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/
CVE-2014-5217 MEDIUM POC
6.8 Dec 23

Cross-site request forgery (CSRF) vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Acce
CVE-2019-10219 MEDIUM POC
6.1 Nov 08

A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
CVE-2014-5216 MEDIUM POC
4.3 Dec 23

Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allow remote atta
CVE-2026-60358 CRITICAL
10.0 Jul 21

Remote unauthenticated compromise of Oracle Access Manager (Fusion Middleware Authentication Engine) in supported versio
CVE-2016-5757 CRITICAL
9.8 Mar 23

iManager Admin Console in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to iFrame

CVE-2014-9412 MEDIUM POC
4.3 Dec 23

Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.1 allow remote attackers

CVE-2026-60333 CRITICAL
9.9 Jul 21

Privilege escalation to full takeover in Oracle Access Manager (Fusion Middleware) 12.2.1.4.0 and 14.1.2.1.0 allows a lo

Same weakness CWE-284 – Improper Access Control

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-83002 REF https://www.oracle.com/security-alerts/cspusep2026.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy