This vulnerability affects the Authentication Engine component of Oracle Access Manager in Oracle Fusion Middleware. It is easily exploitable by a high privileged attacker with network access via HTTP and can result in complete compromise of Oracle Access Manager. The vulnerability also has a scope change, meaning successful exploitation may impact additional Oracle products. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, indicating network attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle has published a Critical Security Patch Update in September 2026 that includes patches for this vulnerability.

Successful exploitation can lead to takeover of Oracle Access Manager, compromising confidentiality, integrity, and availability of the system. Due to scope change, other Oracle products integrated with or dependent on Oracle Access Manager may also be significantly impacted.

Oracle has released security patches for this vulnerability in the September 2026 Critical Security Patch Update. Affected customers should apply these patches without delay. Oracle strongly recommends remaining on actively-supported versions and promptly applying security updates to mitigate this vulnerability. Patch availability and installation instructions are provided in the Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html.