CVE-2026-46812 affects Oracle Access Manager's Authentication Engine component in versions 12.2.1.4.0 and 14.1.2.1.0. It is an easily exploitable vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Exploitation requires user interaction from someone other than the attacker and can result in unauthorized update, insert, or delete access to some accessible data, as well as unauthorized read access to a subset of data. The vulnerability has a CVSS 3.1 score of 6.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low confidentiality and integrity impacts. Oracle’s June 2026 Critical Security Patch Update includes patches for this vulnerability. Oracle strongly urges customers to apply these patches without delay to mitigate the risk. Workarounds include blocking network protocols required for exploitation and restricting privileges, though these may disrupt normal operations.

Successful exploitation can lead to unauthorized read access to some Oracle Access Manager data and unauthorized modification (update, insert, delete) of some accessible data. The vulnerability affects confidentiality and integrity but does not impact availability. The attack requires user interaction from a person other than the attacker and network access via HTTP. The vulnerability also has scope change implications, potentially impacting additional products beyond Oracle Access Manager.

Oracle has released a Critical Security Patch Update in June 2026 that addresses this vulnerability. Customers are strongly advised to apply the June 2026 Critical Security Patch Update promptly to remediate this issue. Until patches are applied, risk may be reduced by blocking network protocols required for the attack and by removing unnecessary privileges or access to certain packages from users who do not require them. However, these mitigations may affect application functionality. Oracle recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory.