CVE-2026-35314 is a vulnerability in the Oracle Access Manager product, specifically in the Web Server Plugin component of Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.1.0. The flaw allows an unauthenticated attacker with network access over HTTP to compromise Oracle Access Manager by gaining unauthorized ability to update, insert, or delete some accessible data, read a subset of accessible data, and cause a partial denial of service. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) indicates network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality, integrity, and availability. Oracle has included a fix for this vulnerability in its June 2026 Critical Security Patch Update. The vendor strongly recommends applying the patch without delay to prevent exploitation.

Successful exploitation allows an unauthenticated remote attacker to perform unauthorized data modification (update, insert, delete) and unauthorized read access to some data within Oracle Access Manager. Additionally, the attacker can cause a partial denial of service condition. This impacts confidentiality, integrity, and availability of the affected system. The vulnerability is exploitable over the network without authentication, increasing the risk of compromise if unpatched.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers should apply the provided security patches as soon as possible. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation or by removing unnecessary privileges from users, though these measures may disrupt application functionality. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory.