CVE-2026-47037: Oracle Access Manager Auth Bypass Flaw

CVE-2026-47037 Overview

CVE-2026-47037 affects the Authentication Engine component of Oracle Access Manager, part of Oracle Fusion Middleware. The supported version 14.1.2.1.0 is affected. A low-privileged attacker with network access via HTTP can exploit this weakness to take over Oracle Access Manager. The flaw is classified under CWE-287 (Improper Authentication) and impacts confidentiality, integrity, and availability. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Successful exploitation results in full takeover of Oracle Access Manager, compromising the identity broker that guards downstream enterprise applications.

Affected Products

Oracle Access Manager 14.1.2.1.0
Oracle Fusion Middleware (Authentication Engine component)
Downstream applications relying on Oracle Access Manager for single sign-on

Discovery Timeline

2026-07-21 - CVE-2026-47037 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-47037

Vulnerability Analysis

CVE-2026-47037 resides in the Authentication Engine of Oracle Access Manager, the module that validates user credentials and issues session tokens for federated access. Improper authentication logic allows an attacker who already holds low-privileged network access to escalate to full control of the Access Manager instance. Because Oracle Access Manager brokers authentication for many downstream Fusion Middleware and custom applications, compromise cascades outward. The attacker gains the ability to read, alter, and disrupt authentication decisions across the protected estate. The vulnerability is remotely reachable over HTTP, requires no user interaction, and is described by Oracle as easily exploitable.

Root Cause

The root cause is an authentication weakness [CWE-287] in how the Authentication Engine validates identity assertions or session state. Insufficient verification permits a low-privileged actor to bypass intended authentication controls and assume higher-trust context within the product.

Attack Vector

Exploitation occurs over the network via HTTP against the Oracle Access Manager service. The attacker needs any low-privileged foothold, such as a basic authenticated user account, and then issues crafted requests against the Authentication Engine endpoint. No verified public proof-of-concept code is available at time of writing. Refer to the Oracle Security Alert July 2026 advisory for technical scope details.

// No verified exploit code is publicly available.
// See Oracle Critical Patch Update - July 2026 for technical scope.

Detection Methods for CVE-2026-47037

Indicators of Compromise

Unexpected administrative or policy changes in Oracle Access Manager audit logs originating from low-privileged accounts.
Anomalous session token issuance or elevation events from the Authentication Engine.
HTTP requests to Oracle Access Manager authentication endpoints containing unusual parameters or repeated authentication attempts from a single source.

Detection Strategies

Correlate Oracle Access Manager audit logs with web server logs to identify privilege changes that lack a corresponding legitimate administrative session.
Baseline normal authentication flows and alert on deviations such as low-privileged users triggering administrative operations.
Hunt for lateral movement from accounts that recently interacted with the Access Manager Authentication Engine.

Monitoring Recommendations

Forward oam_server and OHS access logs to a centralized SIEM for continuous review.
Enable verbose auditing on the Authentication Engine and retain logs for at least 90 days.
Monitor for changes to authentication schemes, policies, and identity store bindings in Oracle Access Manager.

How to Mitigate CVE-2026-47037

Immediate Actions Required

Apply the fixes distributed in the Oracle Critical Patch Update - July 2026 to all Oracle Access Manager 14.1.2.1.0 deployments.
Restrict network reachability of Oracle Access Manager administrative and authentication endpoints to trusted networks.
Rotate credentials and session signing keys after patching if compromise is suspected.
Review recent administrative activity in Oracle Access Manager for signs of abuse.

Patch Information

Oracle addressed CVE-2026-47037 in the July 2026 Critical Patch Update. Administrators should download and apply the patch bundle listed for Oracle Fusion Middleware and specifically for Oracle Access Manager 14.1.2.1.0. Validate patch application by confirming updated binaries and reviewing the post-patch verification steps in the Oracle advisory.

Workarounds

Limit HTTP access to Oracle Access Manager to authenticated administrative networks using firewall or reverse proxy rules until patches are applied.
Disable or tightly scope low-privilege accounts that can reach the Authentication Engine.
Require multi-factor authentication for any account with access to Oracle Access Manager surfaces.

bash

# Example: restrict inbound HTTP to Oracle Access Manager to a management subnet
iptables -A INPUT -p tcp --dport 14100 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 14100 -j DROP