This vulnerability affects the Authentication Engine component of Oracle Access Manager in versions 12.2.1.4.0 and 14.1.2.1.0. It is easily exploitable by unauthenticated attackers over the network via HTTP, enabling them to gain unauthorized access to critical data or perform unauthorized data modifications. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact. The vendor advisory is part of Oracle's July 2026 Critical Patch Update, which addresses this and many other vulnerabilities. However, the advisory does not explicitly confirm the availability of a patch for this specific vulnerability at the time of publication.

Exploitation of this vulnerability can result in unauthorized creation, deletion, or modification of critical data within Oracle Access Manager, as well as unauthorized access to all data accessible through the product. This compromises confidentiality and integrity of the affected system. There is no reported impact on availability. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying Critical Patch Updates promptly to mitigate vulnerabilities. Until a patch is confirmed and applied, restrict network access to Oracle Access Manager instances and monitor for suspicious activity related to unauthorized access attempts.