This vulnerability affects the Authentication Engine component of Oracle Access Manager in versions 12.2.1.4.0 and 14.1.2.1.0. It allows an unauthenticated attacker with network access via HTTP to perform unauthorized read and write operations on accessible data within Oracle Access Manager. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, with limited confidentiality and integrity impacts and no availability impact. Oracle has published this issue in its June 2026 Critical Security Patch Update advisory, which includes 245 security patches across multiple products. The advisory strongly urges customers to apply the patches promptly to mitigate the risk. No explicit patch version or fix details are provided in the input, but the advisory is the authoritative source for remediation guidance.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain unauthorized read access to some data and unauthorized update, insert, or delete access to other data within Oracle Access Manager. This compromises confidentiality and integrity of the affected data. There is no impact on availability. The vulnerability is rated medium severity with a CVSS 3.1 base score of 6.5.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which addresses this vulnerability among others. Customers should remain on actively supported versions and apply security patches without delay. Until patches are applied, risk may be reduced by blocking network protocols required for the attack or by removing unnecessary privileges from users, though these measures may impact application functionality. Patch status is not explicitly confirmed in the provided data; therefore, check the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for current patch availability and installation instructions.