This vulnerability affects the Authentication Engine component of Oracle Access Manager in versions 12.2.1.4.0 and 14.1.2.1.0. It is easily exploitable by an attacker with low privileges who has network access via HTTP. The vulnerability allows unauthorized creation, deletion, or modification of critical data within Oracle Access Manager, unauthorized access to all accessible data, and can cause a partial denial of service. The scope of impact may extend beyond Oracle Access Manager to other Oracle products. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impact with low availability impact. Oracle has included fixes for this vulnerability in their September 2026 Critical Security Patch Update, which contains 673 security patches across multiple products including Oracle Access Manager.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or all data accessible through Oracle Access Manager. It also allows unauthorized access to critical data and can cause a partial denial of service affecting availability. The vulnerability affects confidentiality, integrity, and availability with high severity. Additionally, the impact may extend to other Oracle products due to scope change.

Oracle has released official patches for this vulnerability in the September 2026 Critical Security Patch Update. Customers should apply these patches without delay to mitigate the risk. Oracle strongly recommends remaining on actively supported versions and promptly applying security patches. No alternative mitigations or workarounds are indicated in the vendor advisory.