Improper input validation in Oracle Access Manager - CVE-2026-47065

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU162154

Improper input validation in Oracle Access Manager - CVE-2026-47065

Published: November 8, 2026


Vulnerability identifier: #VU162154
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-47065
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Third Party (Apache Mina) component in Oracle Access Manager. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.


Affected software

Oracle Access Manager
Oracle Middleware Common Libraries and Tools
Oracle Business Process Management Suite
webMethods Integration Server

How to mitigate CVE-2026-47065

Install updates from vendor's website.

webMethods Integration Server - addressed in versions 10.15 Fix 26, 11.1 Fix 9

External References

Related Security Bulletins