This vulnerability exists in the Authentication Engine component of Oracle Access Manager within Oracle Fusion Middleware. It is easily exploitable by an attacker with low privileges and network access via HTTP. Successful exploitation can result in complete compromise of Oracle Access Manager, impacting confidentiality, integrity, and availability. The vulnerability affects versions 12.2.1.4.0 and 14.1.2.1.0. Oracle's September 2026 Critical Security Patch Update includes patches for this vulnerability. The vendor strongly recommends applying these patches promptly to mitigate risk.

Exploitation can lead to full takeover of Oracle Access Manager, compromising confidentiality, integrity, and availability of the system. Due to the scope change, other Oracle products integrated with or dependent on Oracle Access Manager may also be impacted. The CVSS 3.1 score of 9.9 indicates critical severity with network attack vector, low attack complexity, low privileges required, no user interaction, and scope change.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply these patches without delay to mitigate the risk. Oracle strongly recommends remaining on actively supported versions and promptly applying all security patches. No alternative mitigations or workarounds are specified in the advisory.