This vulnerability affects the Authentication Engine component of Oracle Access Manager in versions 12.2.1.4.0 and 14.1.2.1.0. It permits a low privileged attacker who has physical network access to the hardware communication segment to compromise Oracle Access Manager, potentially resulting in complete takeover. The CVSS 3.1 vector indicates the attack requires adjacent network access (AV:A), low complexity (AC:L), low privileges (PR:L), no user interaction (UI:N), unchanged scope (S:U), and results in high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). Oracle’s July 2026 Critical Patch Update advisory includes this vulnerability among many others but does not explicitly state a patch or workaround for it at this time.

Successful exploitation allows an attacker with low privileges and physical network access to the hardware communication segment to fully compromise Oracle Access Manager. This leads to complete loss of confidentiality, integrity, and availability of the Oracle Access Manager service, enabling potential takeover of authentication processes and related security controls.

Oracle’s July 2026 Critical Patch Update advisory includes this vulnerability but does not explicitly confirm patch availability or remediation details. Therefore, patch status is not yet confirmed—check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying all relevant security patches promptly once available. Until a patch is confirmed, restrict physical and network access to the hardware communication segments running Oracle Access Manager to trusted personnel only.