Oracle Access Manager — known CVE vulnerabilities

Every CVE whose affected-product data names Oracle Access Manager, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (20)

• CVE-2026-35313 — CVSS 9.9 (critical): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that…
• CVE-2021-35587 — CVSS 9.8 (critical) — actively exploited: Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: OpenSSO Agent). Supported versions that are…
• CVE-2020-2555 — CVSS 9.8 (critical) — actively exploited: Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Supported versions…
• CVE-2018-2739 — CVSS 9.3 (critical): Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). Supported versions that…
• CVE-2018-2879 — CVSS 9.0 (critical): Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Authentication Engine). Supported versions…
• CVE-2022-39412 — CVSS 7.5 (high): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Admin Console). The supported version that is…
• CVE-2026-35314 — CVSS 7.3 (high): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Web Server Plugin). Supported versions that are…
• CVE-2026-35261 — CVSS 6.5 (medium): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that…
• CVE-2018-2587 — CVSS 6.5 (medium): Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). Supported versions that…
• CVE-2026-46812 — CVSS 6.1 (medium): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that…
• CVE-2019-10219 — CVSS 6.1 (medium): A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of…
• CVE-2017-10262 — CVSS 5.9 (medium): Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). The supported version…
• CVE-2020-2747 — CVSS 5.4 (medium): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: SSO Engine). Supported versions that are…
• CVE-2017-10154 — CVSS 5.3 (medium): Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Web Server Plugin). The supported version…
• CVE-2022-39405 — CVSS 5.3 (medium): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). The supported version…
• CVE-2021-2358 — CVSS 4.9 (medium): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Rest interfaces for Access Mgr). The supported…
• CVE-2021-29425 — CVSS 4.8 (medium): In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or…
• CVE-2020-2740 — CVSS 4.6 (medium): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that…
• CVE-2023-21859 — CVSS 4.4 (medium): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). The supported version…
• CVE-2020-2745 — CVSS 4.3 (medium): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Federation). Supported versions that are…