Vulnerability record · CVE-2018-2879 · published 19 April 2018

CVE-2018-2879: Oracle access manager vulnerability

Oracle · Access Manager

Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Authentication Engine). Supported versions that are affected are 11.1.2.3.0 and 12.2.1.3.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. Note: Please refer to Doc ID <a href="http://support.oracle.com/CSP/main/article?cmd=show&type=NOT&id=2386496.1">My Oracle Support Note 2386496.1 for instructions on how to address this issue. CVSS 3.0 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).

9.0 CVSS 3.0 Critical EPSS 22% · top 2.4%

9.0CVSS 3.0 base score, v2 6.8

22%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

16References, 2 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Access Manager Oracle

References

Link	Tags
http://packetstormsecurity.com/files/152551/OAMbuster-Multi-Threaded-CVE-2018-2879-Scanner.html	Third Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2019/Apr/28	Mailing ListThird Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html	PatchVendor Advisory
http://www.securityfocus.com/bid/103788	Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040695	Third Party AdvisoryVDB Entry
https://github.com/MostafaSoliman/Oracle-OAM-Padding-Oracle-CVE-2018-2879-Exploit	ProductThird Party Advisory
https://seclists.org/bugtraq/2019/Apr/27	Mailing ListThird Party Advisory
https://www.sec-consult.com/en/blog/2018/05/oracle-access-managers-identity-crisis/	ExploitThird Party Advisory
http://packetstormsecurity.com/files/152551/OAMbuster-Multi-Threaded-CVE-2018-2879-Scanner.html	Third Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2019/Apr/28	Mailing ListThird Party Advisory
http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html	PatchVendor Advisory
http://www.securityfocus.com/bid/103788	Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1040695	Third Party AdvisoryVDB Entry
https://github.com/MostafaSoliman/Oracle-OAM-Padding-Oracle-CVE-2018-2879-Exploit	ProductThird Party Advisory
https://seclists.org/bugtraq/2019/Apr/27	Mailing ListThird Party Advisory
https://www.sec-consult.com/en/blog/2018/05/oracle-access-managers-identity-crisis/	ExploitThird Party Advisory

Track CVE-2018-2879 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-35587Oracle Access Manager OpenSSO Agent missing authentication allows takeoverOracle Access Manager (Fusion Middleware) contains a missing-authentication flaw in the OpenSSO Agent component affecting versions 11.1.2.3.0, 12.2.1…KEVEPSS 96%analysed19 Jan 2022 9.8CVE-2020-2555Oracle Coherence T3 deserialization allows unauthenticated remote code executionOracle Coherence (Fusion Middleware) deserializes untrusted data reachable over the T3 protocol, allowing an unauthenticated network attacker to exec…KEVEPSS 97%analysed15 Jan 2020 10.0CVE-2026-71133Oracle access manager improper authentication vulnerabilityVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affect…EPSS 0.51%15 Sep 2026 10.0CVE-2026-60358Oracle access manager improper access control vulnerabilityVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affect…EPSS 0.51%21 Jul 2026 9.9CVE-2026-73945Oracle access manager improper access control vulnerabilityVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affect…EPSS 0.43%15 Sep 2026 9.9CVE-2026-71163Oracle access manager improper access control vulnerabilityVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affect…EPSS 0.39%15 Sep 2026 9.9CVE-2026-60333Oracle access manager improper authentication vulnerabilityVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affect…EPSS 0.43%21 Jul 2026 9.9CVE-2026-35313Oracle access manager improper access control vulnerabilityVulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affect…EPSS 0.43%17 Jun 2026

Source: NIST National Vulnerability Database (record CVE-2018-2879), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.