This vulnerability in the Authentication Engine component of Oracle Access Manager allows an unauthenticated network attacker to exploit the system via HTTP, requiring user interaction from a person other than the attacker. The attack scope extends beyond Oracle Access Manager, potentially impacting additional products. Exploitation can result in unauthorized update, insert, or delete operations on accessible data, as well as unauthorized read access to some data. The CVSS 3.1 base score is 6.1, reflecting medium severity with network attack vector, low attack complexity, no privileges required, required user interaction, scope change, and partial confidentiality and integrity impacts. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update and strongly recommends applying these patches without delay.

Successful exploitation can lead to unauthorized modification (update, insert, delete) and partial unauthorized reading of Oracle Access Manager accessible data, compromising confidentiality and integrity. The vulnerability does not affect availability. The attack requires human interaction from a third party and can be performed remotely over HTTP without authentication. The vulnerability's scope change means it may affect additional Oracle products beyond Access Manager.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update, which includes patches addressing this vulnerability. Until patches are applied, risk may be reduced by blocking network protocols required for the attack and by removing unnecessary privileges or access to vulnerable packages from users who do not require them. These mitigations may impact application functionality. Customers should remain on actively supported versions and apply security patches promptly as per Oracle's advisory: https://www.oracle.com/security-alerts/cspujun2026.html. Patch status is not explicitly confirmed in the advisory excerpt, so customers should verify patch availability and installation instructions in the referenced Critical Security Patch Update documentation.