CVE-2026-35313 is a critical vulnerability in the Authentication Engine component of Oracle Access Manager within Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.1.0. The flaw allows a low privileged attacker with network access over HTTP to compromise Oracle Access Manager, potentially resulting in complete takeover of the product. The vulnerability has a CVSS 3.1 score of 9.9, indicating high impact on confidentiality, integrity, and availability, with scope change affecting additional Oracle products. Oracle's June 2026 Critical Security Patch Update advisory includes this vulnerability among 245 security patches and strongly recommends applying patches promptly. Until patches are applied, risk reduction may be achieved by blocking required network protocols and removing unnecessary privileges, though these may impact functionality.

Successful exploitation of CVE-2026-35313 can lead to full compromise of Oracle Access Manager, affecting confidentiality, integrity, and availability of the system. The vulnerability also has scope change implications, meaning other Oracle products dependent on or integrated with Oracle Access Manager may be impacted. The CVSS 3.1 base score of 9.9 reflects critical severity with network attack vector, low attack complexity, low privileges required, no user interaction, and complete compromise of confidentiality, integrity, and availability.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which includes patches addressing CVE-2026-35313. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation and removing unnecessary privileges from users who do not require them. These mitigations may disrupt application functionality, so patching should be prioritized. Patch status is not explicitly confirmed in the advisory, but Oracle's emphasis on applying the Critical Security Patch Update indicates that fixes are available within this update. Customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for detailed patch availability and installation instructions.