This vulnerability in Oracle Access Manager (component: Web Server Plugin) affects versions 12.2.1.4.0 and 14.1.2.1.0. It allows an unauthenticated attacker with network access over HTTP to compromise the system by gaining unauthorized update, insert, or delete access to some data, unauthorized read access to a subset of data, and the ability to cause a partial denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) indicates network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. Oracle’s June 2026 Critical Security Patch Update advisory includes this vulnerability among 245 security patches and strongly recommends applying patches promptly. The advisory does not explicitly confirm the availability of a patch specifically for this CVE but advises applying the Critical Security Patch Update as a whole.

Successful exploitation can lead to unauthorized modification (update, insert, delete) of some Oracle Access Manager accessible data, unauthorized reading of a subset of accessible data, and partial denial of service conditions affecting Oracle Access Manager availability. The vulnerability affects confidentiality, integrity, and availability with a CVSS score of 7.3 (high severity). No known exploits in the wild have been reported as of the advisory date.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which includes security patches addressing this vulnerability among others. Until patches are applied, risk may be reduced by blocking network protocols required by the attack and by removing unnecessary privileges or access to relevant packages for users who do not require them, though these measures may impact application functionality. Patch status is not explicitly confirmed for this CVE alone; customers should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for the latest patch availability and installation instructions.