Access Manager
Monthly
Full takeover of Oracle Access Manager is achievable by a low-privileged, network-positioned attacker who can reach the product's HTTP Authentication Engine, affecting supported versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware. The flaw requires valid low-privilege credentials (PR:L) and is rated hard to exploit (AC:H), but its scope-change rating means a successful attack against OAM can cascade into the downstream applications that rely on it for single sign-on. As of analysis, no public exploit code and no CISA KEV listing were identified, and the input contained no EPSS score, so real-world exploitation pressure is unquantified despite the 8.5 base score.
Full takeover of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 is achievable by an authenticated, high-privileged attacker who can reach the Authentication Engine over HTTP, with a CVSS 3.1 base score of 9.1 due to low attack complexity, no user interaction, and scope change that can affect integrated identity/SSO products. The PR:H prerequisite means this is realistically an insider or post-compromise privilege-abuse path rather than a remote unauthenticated break-in. No public exploit code was identified at time of analysis and no CISA KEV listing is present in the provided intelligence.
Authenticated attackers holding a low-privileged account can exploit the Authentication Engine in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 over HTTPS to read, create, delete, or modify all data reachable through the service, with CVSS 3.1 base score 9.6 reflecting high confidentiality and integrity impact and a scope change. The flaw is remotely reachable with low attack complexity and no user interaction, but it is not pre-authentication: a valid low-tier credential on the OAM instance is required, which is the main limiting factor on exploitation. No public exploit identified at time of analysis, and the vulnerability is not listed as confirmed actively exploited (CISA KEV); Oracle's Critical Patch Update advisory at https://www.oracle.com/security-alerts/cspusep2026.html is the authoritative source.
Unauthenticated network attackers can achieve full takeover of Oracle Access Manager via a difficult-to-trigger flaw in the Authentication Engine component of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates this CVSS 3.1 8.1 with High confidentiality, integrity, and availability impact from a network vector requiring no privileges or user interaction, meaning the identity service itself — and the applications it protects — can be fully compromised. No public exploit code and no CISA KEV entry were identified at time of analysis; the AC:H rating indicates the attack requires precise timing or a specific non-default state rather than a trivial repeatable request.
Authentication bypass in the Oracle Access Manager (Fusion Middleware) Authentication Engine lets unauthenticated remote attackers with HTTP network access compromise OAM instances running 12.2.1.4.0 or 14.1.2.1.0, resulting in complete takeover of the affected service with high confidentiality, integrity and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Successful exploitation of the CWE-287 flaw effectively grants the attacker the identity and authorization context the Authentication Engine is supposed to enforce, so any downstream application trusting OAM for single sign-on or access decisions is exposed to the same session. At the time of analysis there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified; the practical exposure is driven almost entirely by the network reachability of the OAM Authentication Engine endpoint, with internet-facing gateways the highest priority to patch.
Authentication bypass in Oracle Access Manager 12.2.1.4.0 and 14.1.2.0.0 lets an unauthenticated, network-positioned attacker take over the affected Access Manager instance, rated CVSS 3.1 9.8 (CWE-287, Improper Authentication) with high confidentiality, integrity, and availability impact. The vulnerable component is the Authentication Engine itself, and the vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms no credentials, privileges, or user interaction are required, so any HTTP-reachable OAM deployment of those two versions is a candidate entry point. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); however, Oracle characterizes it as easily exploitable, so internet-exposed OAM instances should be treated as urgent.
Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 contain a flaw in the Authentication Engine component that lets a high-privileged attacker with HTTP network access fully compromise the product, taking over the authentication service itself (CVSS 3.1 base 9.1, AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Because the score includes a scope change (S:C), a successful attack can spill over and significantly impact other products and applications that rely on OAM for authentication, turning a single privileged compromise into a broader identity-layer incident. The critical caveat is the PR:H prerequisite: this is a post-authentication, privileged-abuse issue rather than an unauthenticated remote takeover, so realistic exposure centers on malicious insiders, stolen or misused administrative credentials, or chained privilege-escalation paths. No public exploit code or confirmed exploitation was identified at time of analysis, and the weaknesses make it a priority for patch cycles rather than emergency internet-facing response.
Full takeover of Oracle Access Manager (OAM) is achievable by a low-privileged, authenticated attacker who can reach the Authentication Engine component over HTTP, with no user interaction and low attack complexity, yielding a CVSS 3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Only OAM 12.2.1.4.0 and 14.1.2.1.0 within Oracle Fusion Middleware are listed as affected, but the scope-change rating (S:C) means a successful compromise of the Authentication Engine is not contained to OAM and can significantly impact other products that trust OAM for authentication and federation. No CISA KEV listing and no public exploit code were identified at time of analysis; the practical gate is the requirement for a valid low-privileged account rather than exploit sophistication, which makes this a genuine high-priority issue for any internet-reachable or partner-federated OAM deployment.
Unauthenticated remote attackers can bypass authentication in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0, gaining full read and write access to all data managed by the affected component. This easily exploitable vulnerability (CVSS 9.1) requires only network access to the OAM authentication engine over HTTP and no credentials or user interaction. No public exploit code or active exploitation has been observed at the time of analysis, but the lack of authentication and high impact make it a critical risk for exposed instances.
Unauthenticated attackers with network access to Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 can compromise the Authentication Engine component over HTTP, obtaining unauthorized read access to critical data or all data accessible through the product. Oracle rates this CVSS 3.1 8.6 with a scope change (S:C), meaning affected deployments can be leveraged to significantly impact downstream/connected applications that trust OAM identities. At time of analysis there is no public exploit code identified and no CISA KEV listing, but the attack is trivially automatable (AV:N/AC:L/PR:N/UI:N), so internet-exposed OAM consoles and SSO endpoints should be treated as high priority.
Unauthenticated network attackers who can reach the T3 or IIOP listener fronting Oracle Access Manager's Authentication Engine on versions 12.2.1.4.0 or 14.1.2.1.0 can bypass authentication and take full control of the component, yielding complete loss of confidentiality, integrity, and availability (CVSS 3.1 base 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No credentials or user interaction are required; the only meaningful precondition is that the T3/IIOP protocols are reachable from the attacker's position, so deployments that restrict those protocols to trusted internal networks are not externally exploitable. This vulnerability is not listed in CISA KEV and no public exploit code has been identified at time of analysis, but the combination of a perfect-exploitability CVSS vector, an authentication-bypass root cause, and default-exposed WebLogic remoting protocols makes it a high-priority patch target.
Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 contain a flaw in the Authentication Engine component that lets a high-privileged, network-positioned attacker read, create, delete, or modify data managed by the OAM deployment — and because the flaw crosses a security scope boundary, downstream applications that trust OAM for identity can be affected as well. The CVSS 3.1 base score is 8.7 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), reflecting an easily triggered but credentialed attack with high confidentiality and integrity impact and no availability impact. No public exploit code, EPSS score, or CISA KEV listing is present in the supplied intelligence, so it is treated as not yet publicly exploited at time of analysis; Oracle ships fixes through its Critical Patch Update / Security Alert program referenced in the advisory link.
Authentication weaknesses in the Oracle Access Manager Authentication Engine expose deployments running 12.2.1.4.0 and 14.1.2.1.0 within Oracle Fusion Middleware: an attacker with network access over HTTP and only a low-privileged foothold can bypass or subvert authentication to create, delete, or modify critical data and read data across the OAM-accessible estate, while also degrading service availability. Because the CVSS vector carries a scope change (S:C), a compromise of OAM can propagate to other products that rely on it as their single sign-on and identity provider, which is what pushes the base score to 9.9 rather than the more typical 8.x for an authenticated-only flaw. No user interaction is required and attack complexity is low, though the PR:L rating means the attacker must already hold at least minimal valid access or be able to reach an authenticated interface - this is not a fully unauthenticated pre-auth bypass. There is no CISA KEV listing and no public exploit code identified in the available intelligence, so exploitation is not confirmed actively exploited (CISA KEV) and no public exploit identified at time of analysis.
Authentication bypass in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 lets an unauthenticated remote attacker with HTTP network access compromise the product's Authentication Engine and take over the affected instance. Rated CVSS 3.1 base 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), the scope-change flag means a successful compromise propagates to downstream applications that trust OAM for authentication, widening impact well beyond the OAM host itself. No public exploit has been identified at time of analysis, but the pre-auth, network-reachable attack path makes this a top-tier priority for any organization running the two named versions.
SAML-based authentication bypass and full product takeover affects Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 within Oracle Fusion Middleware's Agent infrastructure component. A remote attacker with no credentials can reach the SAML processing surface over the network and, per Oracle's own rating, easily compromise the identity broker outright - CVSS 9.8 with full confidentiality, integrity, and availability impact. Because Oracle Access Manager is a single-sign-on and access-enforcement gatekeeper, its takeover cascades to every downstream application it protects. No public exploit identified at time of analysis; not listed in CISA KEV.
Remote network compromise of Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 enables a low-privileged authenticated attacker to achieve full system takeover via the Authentication Engine over HTTP, with no user interaction required. Oracle's August 2026 Critical Patch Update advisory rates this CVSS 8.8 (High) and explicitly describes it as 'easily exploitable,' with complete confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Full takeover of Oracle Access Manager is possible via its Authentication Engine component, letting a low-privileged attacker on the same physical/adjacent network segment as the server completely compromise the identity platform. Affected releases are Oracle Fusion Middleware OAM 12.2.1.4.0 and 14.1.2.1.0, carrying a CVSS 3.1 base score of 8.0 with high confidentiality, integrity, and availability impact. Oracle rates it 'easily exploitable' but no public exploit identified at time of analysis, and it is not on CISA KEV.
Full compromise of Oracle Access Manager is possible when an unauthenticated attacker sends crafted HTTP requests to the Authentication Engine component of affected Oracle Fusion Middleware deployments (12.2.1.4.0 and 14.1.2.1.0). The flaw is rated CVSS 9.8 and, per Oracle, is 'easily exploitable,' resulting in complete takeover of the identity/access layer. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, no-authentication profile makes it a high-priority patch for any Oracle SSO estate.
Unauthenticated authentication-bypass in Oracle Access Manager (Oracle Fusion Middleware, Authentication Engine) versions 12.2.1.4.0 and 14.1.2.1.0 lets a remote attacker reach protected data over HTTP without credentials. Because the scope changes, a successful attack can pivot beyond OAM itself and compromise other products that rely on it for single sign-on, exposing critical data across the integrated environment. No public exploit identified at time of analysis; Oracle addressed the flaw in its July 2026 Critical Patch Update.
Full takeover of Oracle Access Manager (Fusion Middleware) is possible via a network-based HTTP attack against the Authentication Engine component in supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated remote attacker (PR:N) can achieve complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), though Oracle rates the attack complexity as high (AC:H), meaning exploitation is difficult and likely requires specific conditions or timing to succeed. This was disclosed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote unauthenticated compromise of Oracle Access Manager (Fusion Middleware Authentication Engine) in supported versions 12.2.1.4.0 and 14.1.2.1.0 allows a network attacker to fully take over the product via HTTP with no credentials or user interaction. Oracle rates this a maximum CVSS 3.1 10.0 because the scope-changing flaw can pivot beyond OAM to impact additional products. No public exploit identified at time of analysis, but as an SSO/identity gatekeeper the impact of takeover is severe.
Unauthenticated authentication-bypass in Oracle Access Manager (Fusion Middleware Authentication Engine, versions 12.2.1.4.0 and 14.1.2.1.0) lets a remote attacker over HTTP compromise the identity/SSO tier and read all data it can access. Because of a CVSS scope change, successful attacks can significantly impact other products that rely on OAM for authentication, magnifying the blast radius. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV; risk is driven by the low-complexity, no-authentication network vector (CVSS 3.1 base 8.6).
Full takeover of Oracle Access Manager (Oracle Fusion Middleware, Authentication Engine component) is achievable by remote unauthenticated attackers over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and affects supported versions 12.2.1.4.0 and 14.1.2.1.0. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS data was not provided.
Privilege escalation to full takeover in Oracle Access Manager (Fusion Middleware) 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged, network-based attacker to compromise the Authentication Engine over HTTP and pivot beyond the product itself (scope change). Because Access Manager brokers single sign-on and authentication for downstream Fusion Middleware applications, its compromise cascades into the identity trust chain. Rated CVSS 3.1 9.9 with full CIA impact; no public exploit identified at time of analysis, and it is addressed in Oracle's July 2026 Critical Patch Update.
Complete takeover of Oracle Access Manager is possible when an unauthenticated attacker with network access sends crafted HTTP requests to the Authentication Engine component of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.1.0 and yields full confidentiality, integrity, and availability compromise (CVSS 9.8). It was disclosed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis.
Cross-site scripting in OpenText Access Manager 5.1 through 5.1.2 lets a remote unauthenticated attacker inject script that executes in the browser of a targeted user of this enterprise SSO/access-management platform (CWE-79). Per the vendor-supplied CVSS 4.0 vector the flaw carries high vulnerable-system confidentiality impact (VC:H) but high attack complexity and a specific attack requirement (AC:H/AT:P), yielding a base score of 8.2. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all versions prior to version 5.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Partial denial of service in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 (Access SDK component) can be triggered by a low-privileged, authenticated attacker who reaches the product over HTTP. The flaw is rated CVSS 3.1 base 3.1 with an availability-only, partial impact, and Oracle characterizes it as difficult to exploit (AC:H), so successful disruption requires favorable timing or state rather than a simple repeatable request. No public exploit code, EPSS score, or CISA KEV entry was present in the supplied intelligence, so there is no indication of active exploitation at time of analysis.
Partial denial-of-service exposure in Oracle Access Manager's Authorization Engine affects supported versions 12.2.1.4.0 and 14.1.2.1.0, reachable by any low-privileged network user over TCP. An authenticated attacker with minimal account privileges can disrupt availability of the Authorization Engine, potentially interrupting access-control decisions for applications federated through OAM. No public exploit code has been identified at time of analysis, and impact is bounded to partial availability degradation with no confidentiality or integrity exposure.
Unauthorized data disclosure in Oracle Access Manager's Authentication Engine allows unauthenticated remote attackers to read a subset of OAM-accessible data over HTTP. Affected versions are 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware's OAM component. Tagged as an Authentication Bypass, the flaw carries a CVSS 5.3 (Medium) rating with low confidentiality impact and no integrity or availability consequences; no public exploit or KEV listing has been identified at time of analysis.
Unauthorized configuration modification in OpenText Access Manager before 5.1.3 allows a remote unauthenticated attacker to alter system configuration via API calls that lack proper authorization enforcement, classified under CWE-648 (Incorrect Use of Privileged APIs). Affected deployments expose privileged API endpoints without adequate access control, enabling integrity impact across both the vulnerable system and subsequent systems relying on it for identity and access decisions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity.
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Admin Console). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Reflected Cross Site Scripting (XSS) vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Information leakage vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Open Redirection vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Injection attack caused the denial of service vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
This release addresses a potential information leakage vulnerability in NetIQ Access Manager versions prior to 5.0.1. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Rest interfaces for Access Mgr). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Authentication Bypass Vulnerability in Micro Focus Access Manager Product, affects all version prior to version 4.5.3.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: SSO Engine). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Federation). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An open redirect vulnerability exists in the Access Manager Identity Provider prior to 4.4 SP3. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Mitigates an XSS issue in NetIQ Access Manager versions prior to 4.4 SP3. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is a time-based blind SQL injection vulnerability in the Access Manager component before 9.18.040 and 10.x before 10.18.040 in ELO ELOenterprise 9 and 10 and ELOprofessional 9 and 10 that makes. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Authentication Engine). Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required.
A cross site scripting vulnerability exist in the Administration Console in NetIQ Access Manager (NAM) 4.3 and 4.4. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A CSRF exposure exists in NetIQ Access Manager (NAM) 4.4 Identity Server component. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Vulnerability exists on Admin Console where an attacker can upload files to the Admin Console server, and potentially execute them. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
An XSS vulnerability on the /NAGErrors URI in NetIQ Access Manager 4.2 and 4.3 exists because Access Gateway Error pages do not validate the HTTP Referer header. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
NetIQ Access Manager 4.2.2 and 4.3.x before 4.3.1+, when configured as an Identity Server, has XSS in the AssertionConsumerServiceURL field of a signed AuthnRequest in a samlp:AuthnRequest document. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
NetIQ Access Manager 4.2 before SP3 HF1 and 4.3 before SP1 HF1, when configured as a SAML 2.0 Identity Server with Virtual Attributes, has a concurrency issue causing information leakage, related to. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable. No vendor patch available.
A cross site request forgery protection mechanism in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be circumvented by repeated uploads causing a high load. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
iManager Admin Console in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to iFrame manipulation attacks, which could allow remote users to gain access to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple components of the web tools in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 were vulnerable to Reflected Cross Site Scripting attacks which could be used to hijack. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to clickjacking attacks due to a missing SAMEORIGIN filter in the "high encryption" setting. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Presence of a .htaccess file could leak information in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before SP2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The SAML2 implementation in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 was handling unsigned SAML requests incorrectly, leaking results to a potentially. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unfiltered finalizer target URL in the SAML processing feature in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 could be used to trigger XSS and leak. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The certificate upload feature in iManager in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to upload JSP pages that would be executed as the iManager user,. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
NetIQ Access Manager 4.1 before 4.1.2 HF 1 and 4.2 before 4.2.2 was parsing incoming SAML requests with external entity resolution enabled, which could lead to local file disclosure via an XML. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
External Entity Processing (XXE) vulnerability in the "risk score" application of NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to disclose the content of local. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.1 allow remote attackers to inject arbitrary web script or HTML via (1) an arbitrary parameter to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Cross-site request forgery (CSRF) vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Access Manager (NAM) 4.x before 4.1 allows remote attackers to hijack the. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allow remote attackers to inject arbitrary web script or HTML via (1) the location parameter in. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allows remote authenticated administrators to discover service-account passwords via a request to (1) roma/jsp/volsc/monitoring/dev_services.jsp or (2). Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
nps/servlet/webacc in iManager in the Administration Console server in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allows remote authenticated novlwww users to read arbitrary files via a query. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Full takeover of Oracle Access Manager is achievable by a low-privileged, network-positioned attacker who can reach the product's HTTP Authentication Engine, affecting supported versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware. The flaw requires valid low-privilege credentials (PR:L) and is rated hard to exploit (AC:H), but its scope-change rating means a successful attack against OAM can cascade into the downstream applications that rely on it for single sign-on. As of analysis, no public exploit code and no CISA KEV listing were identified, and the input contained no EPSS score, so real-world exploitation pressure is unquantified despite the 8.5 base score.
Full takeover of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 is achievable by an authenticated, high-privileged attacker who can reach the Authentication Engine over HTTP, with a CVSS 3.1 base score of 9.1 due to low attack complexity, no user interaction, and scope change that can affect integrated identity/SSO products. The PR:H prerequisite means this is realistically an insider or post-compromise privilege-abuse path rather than a remote unauthenticated break-in. No public exploit code was identified at time of analysis and no CISA KEV listing is present in the provided intelligence.
Authenticated attackers holding a low-privileged account can exploit the Authentication Engine in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 over HTTPS to read, create, delete, or modify all data reachable through the service, with CVSS 3.1 base score 9.6 reflecting high confidentiality and integrity impact and a scope change. The flaw is remotely reachable with low attack complexity and no user interaction, but it is not pre-authentication: a valid low-tier credential on the OAM instance is required, which is the main limiting factor on exploitation. No public exploit identified at time of analysis, and the vulnerability is not listed as confirmed actively exploited (CISA KEV); Oracle's Critical Patch Update advisory at https://www.oracle.com/security-alerts/cspusep2026.html is the authoritative source.
Unauthenticated network attackers can achieve full takeover of Oracle Access Manager via a difficult-to-trigger flaw in the Authentication Engine component of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates this CVSS 3.1 8.1 with High confidentiality, integrity, and availability impact from a network vector requiring no privileges or user interaction, meaning the identity service itself — and the applications it protects — can be fully compromised. No public exploit code and no CISA KEV entry were identified at time of analysis; the AC:H rating indicates the attack requires precise timing or a specific non-default state rather than a trivial repeatable request.
Authentication bypass in the Oracle Access Manager (Fusion Middleware) Authentication Engine lets unauthenticated remote attackers with HTTP network access compromise OAM instances running 12.2.1.4.0 or 14.1.2.1.0, resulting in complete takeover of the affected service with high confidentiality, integrity and availability impact (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Successful exploitation of the CWE-287 flaw effectively grants the attacker the identity and authorization context the Authentication Engine is supposed to enforce, so any downstream application trusting OAM for single sign-on or access decisions is exposed to the same session. At the time of analysis there is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified; the practical exposure is driven almost entirely by the network reachability of the OAM Authentication Engine endpoint, with internet-facing gateways the highest priority to patch.
Authentication bypass in Oracle Access Manager 12.2.1.4.0 and 14.1.2.0.0 lets an unauthenticated, network-positioned attacker take over the affected Access Manager instance, rated CVSS 3.1 9.8 (CWE-287, Improper Authentication) with high confidentiality, integrity, and availability impact. The vulnerable component is the Authentication Engine itself, and the vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms no credentials, privileges, or user interaction are required, so any HTTP-reachable OAM deployment of those two versions is a candidate entry point. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); however, Oracle characterizes it as easily exploitable, so internet-exposed OAM instances should be treated as urgent.
Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 contain a flaw in the Authentication Engine component that lets a high-privileged attacker with HTTP network access fully compromise the product, taking over the authentication service itself (CVSS 3.1 base 9.1, AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). Because the score includes a scope change (S:C), a successful attack can spill over and significantly impact other products and applications that rely on OAM for authentication, turning a single privileged compromise into a broader identity-layer incident. The critical caveat is the PR:H prerequisite: this is a post-authentication, privileged-abuse issue rather than an unauthenticated remote takeover, so realistic exposure centers on malicious insiders, stolen or misused administrative credentials, or chained privilege-escalation paths. No public exploit code or confirmed exploitation was identified at time of analysis, and the weaknesses make it a priority for patch cycles rather than emergency internet-facing response.
Full takeover of Oracle Access Manager (OAM) is achievable by a low-privileged, authenticated attacker who can reach the Authentication Engine component over HTTP, with no user interaction and low attack complexity, yielding a CVSS 3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Only OAM 12.2.1.4.0 and 14.1.2.1.0 within Oracle Fusion Middleware are listed as affected, but the scope-change rating (S:C) means a successful compromise of the Authentication Engine is not contained to OAM and can significantly impact other products that trust OAM for authentication and federation. No CISA KEV listing and no public exploit code were identified at time of analysis; the practical gate is the requirement for a valid low-privileged account rather than exploit sophistication, which makes this a genuine high-priority issue for any internet-reachable or partner-federated OAM deployment.
Unauthenticated remote attackers can bypass authentication in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0, gaining full read and write access to all data managed by the affected component. This easily exploitable vulnerability (CVSS 9.1) requires only network access to the OAM authentication engine over HTTP and no credentials or user interaction. No public exploit code or active exploitation has been observed at the time of analysis, but the lack of authentication and high impact make it a critical risk for exposed instances.
Unauthenticated attackers with network access to Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 can compromise the Authentication Engine component over HTTP, obtaining unauthorized read access to critical data or all data accessible through the product. Oracle rates this CVSS 3.1 8.6 with a scope change (S:C), meaning affected deployments can be leveraged to significantly impact downstream/connected applications that trust OAM identities. At time of analysis there is no public exploit code identified and no CISA KEV listing, but the attack is trivially automatable (AV:N/AC:L/PR:N/UI:N), so internet-exposed OAM consoles and SSO endpoints should be treated as high priority.
Unauthenticated network attackers who can reach the T3 or IIOP listener fronting Oracle Access Manager's Authentication Engine on versions 12.2.1.4.0 or 14.1.2.1.0 can bypass authentication and take full control of the component, yielding complete loss of confidentiality, integrity, and availability (CVSS 3.1 base 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No credentials or user interaction are required; the only meaningful precondition is that the T3/IIOP protocols are reachable from the attacker's position, so deployments that restrict those protocols to trusted internal networks are not externally exploitable. This vulnerability is not listed in CISA KEV and no public exploit code has been identified at time of analysis, but the combination of a perfect-exploitability CVSS vector, an authentication-bypass root cause, and default-exposed WebLogic remoting protocols makes it a high-priority patch target.
Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 contain a flaw in the Authentication Engine component that lets a high-privileged, network-positioned attacker read, create, delete, or modify data managed by the OAM deployment — and because the flaw crosses a security scope boundary, downstream applications that trust OAM for identity can be affected as well. The CVSS 3.1 base score is 8.7 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), reflecting an easily triggered but credentialed attack with high confidentiality and integrity impact and no availability impact. No public exploit code, EPSS score, or CISA KEV listing is present in the supplied intelligence, so it is treated as not yet publicly exploited at time of analysis; Oracle ships fixes through its Critical Patch Update / Security Alert program referenced in the advisory link.
Authentication weaknesses in the Oracle Access Manager Authentication Engine expose deployments running 12.2.1.4.0 and 14.1.2.1.0 within Oracle Fusion Middleware: an attacker with network access over HTTP and only a low-privileged foothold can bypass or subvert authentication to create, delete, or modify critical data and read data across the OAM-accessible estate, while also degrading service availability. Because the CVSS vector carries a scope change (S:C), a compromise of OAM can propagate to other products that rely on it as their single sign-on and identity provider, which is what pushes the base score to 9.9 rather than the more typical 8.x for an authenticated-only flaw. No user interaction is required and attack complexity is low, though the PR:L rating means the attacker must already hold at least minimal valid access or be able to reach an authenticated interface - this is not a fully unauthenticated pre-auth bypass. There is no CISA KEV listing and no public exploit code identified in the available intelligence, so exploitation is not confirmed actively exploited (CISA KEV) and no public exploit identified at time of analysis.
Authentication bypass in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 lets an unauthenticated remote attacker with HTTP network access compromise the product's Authentication Engine and take over the affected instance. Rated CVSS 3.1 base 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), the scope-change flag means a successful compromise propagates to downstream applications that trust OAM for authentication, widening impact well beyond the OAM host itself. No public exploit has been identified at time of analysis, but the pre-auth, network-reachable attack path makes this a top-tier priority for any organization running the two named versions.
SAML-based authentication bypass and full product takeover affects Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 within Oracle Fusion Middleware's Agent infrastructure component. A remote attacker with no credentials can reach the SAML processing surface over the network and, per Oracle's own rating, easily compromise the identity broker outright - CVSS 9.8 with full confidentiality, integrity, and availability impact. Because Oracle Access Manager is a single-sign-on and access-enforcement gatekeeper, its takeover cascades to every downstream application it protects. No public exploit identified at time of analysis; not listed in CISA KEV.
Remote network compromise of Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 enables a low-privileged authenticated attacker to achieve full system takeover via the Authentication Engine over HTTP, with no user interaction required. Oracle's August 2026 Critical Patch Update advisory rates this CVSS 8.8 (High) and explicitly describes it as 'easily exploitable,' with complete confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Full takeover of Oracle Access Manager is possible via its Authentication Engine component, letting a low-privileged attacker on the same physical/adjacent network segment as the server completely compromise the identity platform. Affected releases are Oracle Fusion Middleware OAM 12.2.1.4.0 and 14.1.2.1.0, carrying a CVSS 3.1 base score of 8.0 with high confidentiality, integrity, and availability impact. Oracle rates it 'easily exploitable' but no public exploit identified at time of analysis, and it is not on CISA KEV.
Full compromise of Oracle Access Manager is possible when an unauthenticated attacker sends crafted HTTP requests to the Authentication Engine component of affected Oracle Fusion Middleware deployments (12.2.1.4.0 and 14.1.2.1.0). The flaw is rated CVSS 9.8 and, per Oracle, is 'easily exploitable,' resulting in complete takeover of the identity/access layer. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, no-authentication profile makes it a high-priority patch for any Oracle SSO estate.
Unauthenticated authentication-bypass in Oracle Access Manager (Oracle Fusion Middleware, Authentication Engine) versions 12.2.1.4.0 and 14.1.2.1.0 lets a remote attacker reach protected data over HTTP without credentials. Because the scope changes, a successful attack can pivot beyond OAM itself and compromise other products that rely on it for single sign-on, exposing critical data across the integrated environment. No public exploit identified at time of analysis; Oracle addressed the flaw in its July 2026 Critical Patch Update.
Full takeover of Oracle Access Manager (Fusion Middleware) is possible via a network-based HTTP attack against the Authentication Engine component in supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated remote attacker (PR:N) can achieve complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), though Oracle rates the attack complexity as high (AC:H), meaning exploitation is difficult and likely requires specific conditions or timing to succeed. This was disclosed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote unauthenticated compromise of Oracle Access Manager (Fusion Middleware Authentication Engine) in supported versions 12.2.1.4.0 and 14.1.2.1.0 allows a network attacker to fully take over the product via HTTP with no credentials or user interaction. Oracle rates this a maximum CVSS 3.1 10.0 because the scope-changing flaw can pivot beyond OAM to impact additional products. No public exploit identified at time of analysis, but as an SSO/identity gatekeeper the impact of takeover is severe.
Unauthenticated authentication-bypass in Oracle Access Manager (Fusion Middleware Authentication Engine, versions 12.2.1.4.0 and 14.1.2.1.0) lets a remote attacker over HTTP compromise the identity/SSO tier and read all data it can access. Because of a CVSS scope change, successful attacks can significantly impact other products that rely on OAM for authentication, magnifying the blast radius. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV; risk is driven by the low-complexity, no-authentication network vector (CVSS 3.1 base 8.6).
Full takeover of Oracle Access Manager (Oracle Fusion Middleware, Authentication Engine component) is achievable by remote unauthenticated attackers over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and affects supported versions 12.2.1.4.0 and 14.1.2.1.0. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS data was not provided.
Privilege escalation to full takeover in Oracle Access Manager (Fusion Middleware) 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged, network-based attacker to compromise the Authentication Engine over HTTP and pivot beyond the product itself (scope change). Because Access Manager brokers single sign-on and authentication for downstream Fusion Middleware applications, its compromise cascades into the identity trust chain. Rated CVSS 3.1 9.9 with full CIA impact; no public exploit identified at time of analysis, and it is addressed in Oracle's July 2026 Critical Patch Update.
Complete takeover of Oracle Access Manager is possible when an unauthenticated attacker with network access sends crafted HTTP requests to the Authentication Engine component of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.1.0 and yields full confidentiality, integrity, and availability compromise (CVSS 9.8). It was disclosed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis.
Cross-site scripting in OpenText Access Manager 5.1 through 5.1.2 lets a remote unauthenticated attacker inject script that executes in the browser of a targeted user of this enterprise SSO/access-management platform (CWE-79). Per the vendor-supplied CVSS 4.0 vector the flaw carries high vulnerable-system confidentiality impact (VC:H) but high attack complexity and a specific attack requirement (AC:H/AT:P), yielding a base score of 8.2. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Advance configuration exposing Information Leakage vulnerability in Micro Focus Access Manager product, affects all versions prior to version 5.0. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Partial denial of service in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 (Access SDK component) can be triggered by a low-privileged, authenticated attacker who reaches the product over HTTP. The flaw is rated CVSS 3.1 base 3.1 with an availability-only, partial impact, and Oracle characterizes it as difficult to exploit (AC:H), so successful disruption requires favorable timing or state rather than a simple repeatable request. No public exploit code, EPSS score, or CISA KEV entry was present in the supplied intelligence, so there is no indication of active exploitation at time of analysis.
Partial denial-of-service exposure in Oracle Access Manager's Authorization Engine affects supported versions 12.2.1.4.0 and 14.1.2.1.0, reachable by any low-privileged network user over TCP. An authenticated attacker with minimal account privileges can disrupt availability of the Authorization Engine, potentially interrupting access-control decisions for applications federated through OAM. No public exploit code has been identified at time of analysis, and impact is bounded to partial availability degradation with no confidentiality or integrity exposure.
Unauthorized data disclosure in Oracle Access Manager's Authentication Engine allows unauthenticated remote attackers to read a subset of OAM-accessible data over HTTP. Affected versions are 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware's OAM component. Tagged as an Authentication Bypass, the flaw carries a CVSS 5.3 (Medium) rating with low confidentiality impact and no integrity or availability consequences; no public exploit or KEV listing has been identified at time of analysis.
Unauthorized configuration modification in OpenText Access Manager before 5.1.3 allows a remote unauthenticated attacker to alter system configuration via API calls that lack proper authorization enforcement, classified under CWE-648 (Incorrect Use of Privileged APIs). Affected deployments expose privileged API endpoints without adequate access control, enabling integrity impact across both the vulnerable system and subsequent systems relying on it for identity and access decisions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity.
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Admin Console). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Reflected Cross Site Scripting (XSS) vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Information leakage vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Open Redirection vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Injection attack caused the denial of service vulnerability in NetIQ Access Manager prior to 5.0.1 and 4.5.4. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
This release addresses a potential information leakage vulnerability in NetIQ Access Manager versions prior to 5.0.1. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Rest interfaces for Access Mgr). Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Authentication Bypass Vulnerability in Micro Focus Access Manager Product, affects all version prior to version 4.5.3.3. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: SSO Engine). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Federation). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Rated medium severity (CVSS 4.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An open redirect vulnerability exists in the Access Manager Identity Provider prior to 4.4 SP3. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Mitigates an XSS issue in NetIQ Access Manager versions prior to 4.4 SP3. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
There is a time-based blind SQL injection vulnerability in the Access Manager component before 9.18.040 and 10.x before 10.18.040 in ELO ELOenterprise 9 and 10 and ELOprofessional 9 and 10 that makes. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Authentication Engine). Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required.
A cross site scripting vulnerability exist in the Administration Console in NetIQ Access Manager (NAM) 4.3 and 4.4. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A CSRF exposure exists in NetIQ Access Manager (NAM) 4.4 Identity Server component. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A Vulnerability exists on Admin Console where an attacker can upload files to the Admin Console server, and potentially execute them. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.
An XSS vulnerability on the /NAGErrors URI in NetIQ Access Manager 4.2 and 4.3 exists because Access Gateway Error pages do not validate the HTTP Referer header. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
NetIQ Access Manager 4.2.2 and 4.3.x before 4.3.1+, when configured as an Identity Server, has XSS in the AssertionConsumerServiceURL field of a signed AuthnRequest in a samlp:AuthnRequest document. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
NetIQ Access Manager 4.2 before SP3 HF1 and 4.3 before SP1 HF1, when configured as a SAML 2.0 Identity Server with Virtual Attributes, has a concurrency issue causing information leakage, related to. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable. No vendor patch available.
A cross site request forgery protection mechanism in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be circumvented by repeated uploads causing a high load. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
iManager Admin Console in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to iFrame manipulation attacks, which could allow remote users to gain access to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple components of the web tools in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 were vulnerable to Reflected Cross Site Scripting attacks which could be used to hijack. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to clickjacking attacks due to a missing SAMEORIGIN filter in the "high encryption" setting. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Presence of a .htaccess file could leak information in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before SP2. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The SAML2 implementation in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 was handling unsigned SAML requests incorrectly, leaking results to a potentially. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An unfiltered finalizer target URL in the SAML processing feature in Identity Server in NetIQ Access Manager 4.1 before 4.1.2 HF1 and 4.2 before 4.2.2 could be used to trigger XSS and leak. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The certificate upload feature in iManager in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to upload JSP pages that would be executed as the iManager user,. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
NetIQ Access Manager 4.1 before 4.1.2 HF 1 and 4.2 before 4.2.2 was parsing incoming SAML requests with external entity resolution enabled, which could lead to local file disclosure via an XML. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
External Entity Processing (XXE) vulnerability in the "risk score" application of NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 could be used to disclose the content of local. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.1 allow remote attackers to inject arbitrary web script or HTML via (1) an arbitrary parameter to. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Cross-site request forgery (CSRF) vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Access Manager (NAM) 4.x before 4.1 allows remote attackers to hijack the. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allow remote attackers to inject arbitrary web script or HTML via (1) the location parameter in. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allows remote authenticated administrators to discover service-account passwords via a request to (1) roma/jsp/volsc/monitoring/dev_services.jsp or (2). Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
nps/servlet/webacc in iManager in the Administration Console server in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allows remote authenticated novlwww users to read arbitrary files via a query. Rated medium severity (CVSS 4.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.