This vulnerability in Oracle Access Manager's Authentication Engine allows unauthenticated network attackers to read a subset of accessible data without authorization. It affects versions 12.2.1.4.0 and 14.1.2.1.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates network attack vector, low attack complexity, no privileges or user interaction required, and limited confidentiality impact without integrity or availability impact. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation level for it. Oracle advises customers to remain on supported versions and apply security patches without delay.

Successful exploitation allows an unauthenticated attacker to gain unauthorized read access to some data within Oracle Access Manager. This compromises confidentiality but does not affect integrity or availability. The impact is limited to a subset of accessible data, not full system compromise.

Oracle's advisory does not explicitly state a patch or remediation level for this specific vulnerability. Customers should consult the Oracle Critical Patch Update July 2026 advisory and apply all relevant security patches promptly. No vendor statement indicates that no action is required or that the issue is already mitigated. Therefore, timely patching according to Oracle's guidance is recommended.