This vulnerability affects the Authentication Engine component of Oracle Access Manager in versions 12.2.1.4.0 and 14.1.2.1.0. It can be exploited remotely without authentication over HTTP, enabling attackers to gain unauthorized access and perform critical data operations such as creation, deletion, or modification. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects that the attack requires no privileges or user interaction and results in high confidentiality and integrity impact. No official remediation level or patch information is explicitly stated in the provided data, but Oracle's July 2026 Critical Patch Update advisory references security patches for Oracle Access Manager, implying patches are available. The vendor strongly recommends applying patches promptly to mitigate such vulnerabilities.

Exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Access Manager or unauthorized access to all data accessible by the product. This compromises confidentiality and integrity of sensitive data managed by Oracle Access Manager. There is no reported impact on availability. No known exploits in the wild have been reported as of the publication date.

Oracle's July 2026 Critical Patch Update advisory includes security patches addressing this vulnerability in Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0. Customers are strongly advised to apply the relevant patches without delay to remediate this vulnerability. Since this is not a cloud service, patching must be performed by the customer. No vendor advisory states that no action is required or that the issue is already mitigated without patching. Therefore, applying the official patches is the recommended mitigation.