This vulnerability affects the Authentication Engine component of Oracle Access Manager in versions 12.2.1.4.0 and 14.1.2.1.0. It is exploitable by an attacker with low privileges who has access to the physical communication segment attached to the hardware where Oracle Access Manager runs. The vulnerability has a CVSS 3.1 base score of 8.0, indicating high severity with high impact on confidentiality, integrity, and availability. The weakness is categorized under CWE-284 (Improper Access Control). No official patch or remediation level is currently specified in the vendor advisory. Oracle's Critical Patch Update advisory for July 2026 mentions many patches but does not explicitly confirm a patch for this specific vulnerability. Customers are advised to monitor Oracle's security alerts for updates and apply patches promptly when available.

Exploitation of this vulnerability can result in complete compromise of Oracle Access Manager, allowing an attacker to gain unauthorized control over the system. This impacts the confidentiality, integrity, and availability of Oracle Access Manager, potentially affecting authentication and access control mechanisms dependent on it.

Patch status is not yet confirmed—check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends that customers remain on actively supported versions and apply security patches without delay once available. Until a patch is released, restrict physical and network access to the communication segments attached to Oracle Access Manager hardware to trusted personnel only.