This vulnerability affects the Authentication Engine component of Oracle Access Manager in versions 12.2.1.4.0 and 14.1.2.1.0. It is easily exploitable by unauthenticated attackers over the network via HTTP, allowing complete takeover of Oracle Access Manager. The scope of impact extends beyond Oracle Access Manager, potentially affecting other Oracle products integrated with it. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects a network attack vector with low attack complexity, no privileges or user interaction required, and complete compromise of confidentiality, integrity, and availability. Oracle’s September 2026 Critical Security Patch Update includes patches for this vulnerability, and Oracle strongly urges customers to apply these patches promptly.

Successful exploitation results in full compromise of Oracle Access Manager, including confidentiality, integrity, and availability impacts. This can lead to takeover of the Oracle Access Manager system and may affect additional Oracle products due to integration dependencies. The vulnerability is remotely exploitable without authentication, making it highly dangerous in exposed environments.

Oracle has released patches for this vulnerability in its September 2026 Critical Security Patch Update. Customers should apply the official security patches immediately to remediate the vulnerability. Oracle strongly recommends remaining on actively supported versions and applying all security patches without delay. No alternative mitigations or workarounds are specified in the advisory.