This vulnerability affects the Authentication Engine component of Oracle Access Manager in versions 12.2.1.4.0 and 14.1.2.1.0. It permits an attacker with low privileges and physical access to the communication segment attached to the hardware where Oracle Access Manager runs to compromise the system. The CVSS 3.1 vector (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates that the attack requires adjacent network access, low attack complexity, and low privileges without user interaction, resulting in high confidentiality, integrity, and availability impacts. Oracle has published this vulnerability in its July 2026 Critical Patch Update advisory but has not yet provided explicit patch or mitigation instructions for this specific vulnerability.

Successful exploitation of this vulnerability can result in full compromise and takeover of Oracle Access Manager, impacting confidentiality, integrity, and availability of the system. This could allow attackers to bypass authentication controls and potentially manipulate or disrupt access management functions.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the vendor advisory does not explicitly confirm the availability of a patch or provide specific remediation instructions for this vulnerability at this time. Customers are strongly advised to monitor the Oracle Critical Patch Update advisory for patch releases and apply security updates promptly once available. Until then, limit physical and network access to the communication segments attached to Oracle Access Manager hardware to reduce exposure.