This vulnerability affects the Authentication Engine component of Oracle Access Manager in Oracle Fusion Middleware. It is easily exploitable by an attacker with low privileges and network access over HTTP, enabling compromise of Oracle Access Manager. The vulnerability has a CVSS 3.1 base score of 9.9, indicating critical impact on confidentiality, integrity, and availability. Successful exploitation can lead to takeover of Oracle Access Manager and may impact other Oracle products. Oracle's June 2026 Critical Security Patch Update advisory includes this vulnerability and strongly recommends applying patches promptly. Mitigations include blocking network protocols required by the attack and removing unnecessary privileges, though these may affect functionality.

Successful exploitation allows an attacker with low privileges and network access via HTTP to fully compromise Oracle Access Manager, resulting in complete loss of confidentiality, integrity, and availability of the product. Due to scope change, other Oracle products integrated with or dependent on Oracle Access Manager may also be significantly impacted.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update as soon as possible to remediate this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required by the attack and removing unnecessary privileges or package access from users who do not need them. These mitigations may disrupt application functionality. Patch status is not explicitly confirmed in the advisory text, but the Critical Security Patch Update contains targeted fixes addressing this vulnerability. Customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for detailed patch availability and installation instructions.