This vulnerability in Oracle Access Manager's Authentication Engine allows unauthenticated remote attackers to compromise the system via HTTP network access. The affected versions are 12.2.1.4.0 and 14.1.2.1.0. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates that the attack requires no privileges or user interaction and can fully compromise confidentiality, integrity, and availability. The vulnerability is classified under CWE-287 (Improper Authentication). Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for Oracle Access Manager. No known exploits in the wild have been reported as of the advisory date.

Successful exploitation allows an unauthenticated attacker to take over Oracle Access Manager, impacting confidentiality, integrity, and availability of the system. This can lead to full compromise of authentication mechanisms and potentially broader access within affected environments.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, no explicit patch or remediation details for Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 are currently provided. Customers should closely monitor the Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html for updates on patch availability and apply security patches promptly once released. Until a patch is available, restricting network access to Oracle Access Manager and applying compensating controls may reduce exposure.