This vulnerability affects the Authentication Engine component of Oracle Access Manager in versions 12.2.1.4.0 and 14.1.2.1.0. It allows an unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager, requiring user interaction from a third party. The scope of impact extends beyond Oracle Access Manager to additional products. Exploitation can result in unauthorized update, insert, or delete operations on some accessible data, as well as unauthorized read access to a subset of data. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impacts with no availability impact. Oracle’s July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly state the patch status for it.

Successful exploitation can lead to unauthorized modification (update, insert, delete) and unauthorized reading of some Oracle Access Manager accessible data, impacting confidentiality and integrity. The vulnerability requires user interaction from a third party and affects the security scope beyond Oracle Access Manager itself. There is no reported availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly and remaining on actively supported versions. Until official patches or mitigations are confirmed, monitor Oracle advisories for updates. No vendor advisory states that no action is required or that the issue is already mitigated.