CVE-2026-61065 affects the Authentication Engine component of Oracle Access Manager in versions 12.2.1.4.0 and 14.1.2.1.0. It is an easily exploitable vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager, resulting in potential full system takeover. The vulnerability is rated critical with a CVSS 3.1 score of 9.8, reflecting high impact on confidentiality, integrity, and availability. The official Oracle Critical Patch Update advisory for July 2026 references this vulnerability as part of a large set of patches but does not explicitly confirm patch availability or remediation status for this specific issue. Customers are urged to remain on supported versions and apply security patches without delay.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Access Manager, impacting confidentiality, integrity, and availability of the system. This could allow attackers to take over the authentication infrastructure, potentially affecting all dependent applications and services.

Patch status is not yet confirmed — check the Oracle July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends that customers apply security patches promptly and remain on actively supported versions to mitigate this and other vulnerabilities.