This vulnerability affects the Authentication Engine component of Oracle Access Manager in versions 12.2.1.4.0 and 14.1.2.1.0. It is easily exploitable over the network without authentication, allowing attackers to gain unauthorized access and perform critical data operations such as creation, deletion, or modification. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects that the attack requires no privileges or user interaction and can fully compromise confidentiality and integrity. Oracle has included fixes for this vulnerability in their September 2026 Critical Security Patch Update, which contains 673 security patches across multiple products including Oracle Access Manager. The vendor strongly recommends applying these patches without delay to prevent exploitation.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain unauthorized creation, deletion, or modification rights over critical data managed by Oracle Access Manager. This can lead to complete compromise of confidentiality and integrity of all data accessible through Oracle Access Manager. There is no direct impact on availability reported. The vulnerability is rated critical with a CVSS score of 9.1.

Oracle has released an official fix for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should promptly apply the relevant patches for Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 to remediate this issue. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation.