Oracle Access Manager vulnerabilities

53 CVEs affecting Oracle Access Manager, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-83369, published 2026-09-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-2555: Oracle Multiple Products Remote Code Execution Vulnerability, published 2020-01-15. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 97.1% chance of exploitation in the next 30 days. Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions that are affected are 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0 and…
CVE-2021-35587: Oracle Fusion Middleware Unspecified Vulnerability, published 2022-01-19. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-11-28. EPSS: 96.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are affected are 11.1.2.3.0, 12.2.1.3.0 and 12.2.1.4.0. Easily…
CVE-2018-2879, published 2018-04-19. Critical severity, CVSS 9.0. EPSS: 21.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Authentication Engine). Supported versions that are affected are 11.1.2.3.0 and 12.2.1.3.0. Difficult…
CVE-2021-29425, published 2021-04-13. Medium severity, CVSS 4.8. EPSS: 10.5% chance of exploitation in the next 30 days. In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\\..\foo", the result would be the same value, thus possibly…
CVE-2018-2739, published 2018-04-19. Critical severity, CVSS 9.3. EPSS: 2.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). Supported versions that are affected are 10.1.4.3.0, 11.1.2.3.0 and 12.2.1.3.0.…
CVE-2022-39412, published 2022-10-18. High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Admin Console). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability…
CVE-2019-10219, published 2019-11-08. Medium severity, CVSS 6.1. EPSS: 2.2% chance of exploitation in the next 30 days. A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions.…
CVE-2018-2587, published 2018-04-19. Medium severity, CVSS 6.5. EPSS: 2% chance of exploitation in the next 30 days. Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). Supported versions that are affected are 10.1.4.3.0, 11.1.2.3.0 and 12.2.1.3.0.…
CVE-2017-10154, published 2017-10-19. Medium severity, CVSS 5.3. EPSS: 1.9% chance of exploitation in the next 30 days. Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). The supported version that is affected is 11.1.2.3.0. Easily exploitable…
CVE-2021-2358, published 2021-07-21. Medium severity, CVSS 4.9. EPSS: 1.6% chance of exploitation in the next 30 days. Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Rest interfaces for Access Mgr). The supported version that is affected is 11.1.2.3.0. Easily exploitable…

Latest

CVE-2026-83369, published 2026-09-15. Low severity, CVSS 3.1. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Access SDK). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit…
CVE-2026-83002, published 2026-09-15. High severity, CVSS 8.5. EPSS: 0.3% chance of exploitation in the next 30 days. Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to…
CVE-2026-83001, published 2026-09-15. Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily…
CVE-2026-73962, published 2026-09-15. Critical severity, CVSS 9.6. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily…
CVE-2026-73958, published 2026-09-15. High severity, CVSS 8.1. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to…
CVE-2026-73950, published 2026-09-15. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily…
CVE-2026-73947, published 2026-09-15. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily…
CVE-2026-73946, published 2026-09-15. Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days. Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily…
CVE-2026-73945, published 2026-09-15. Critical severity, CVSS 9.9. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily…
CVE-2026-73944, published 2026-09-15. Critical severity, CVSS 9.1. EPSS: 0.4% chance of exploitation in the next 30 days. Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily…