This vulnerability exists in the Authentication Engine component of Oracle Access Manager within Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.1.0. The flaw is easily exploitable by a high privileged attacker with network access via HTTP, enabling compromise of Oracle Access Manager. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data, or unauthorized access to all data accessible by Oracle Access Manager. The vulnerability has a CVSS 3.1 score of 8.7 with vector AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N, indicating network attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high confidentiality and integrity impacts without availability impact. Oracle has included a fix for this vulnerability in their September 2026 Critical Security Patch Update, which contains 673 security patches across multiple products including Oracle Access Manager.

Exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Access Manager, as well as unauthorized access to all data accessible by Oracle Access Manager. The vulnerability also has a scope change, meaning it may impact additional Oracle products beyond Access Manager. The confidentiality and integrity of sensitive data are severely impacted, but availability is not affected. This can result in significant security breaches if exploited.

Oracle has released security patches for this vulnerability in the September 2026 Critical Security Patch Update. Customers should apply the provided patches for Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 without delay. Oracle strongly recommends remaining on actively supported versions and applying security patches promptly to prevent exploitation. No alternative mitigations or workarounds are specified in the advisory.