This vulnerability affects the Authentication Engine component of Oracle Access Manager in versions 12.2.1.4.0 and 14.1.2.1.0. It is easily exploitable by an attacker with low privileges and network access over HTTPS, allowing compromise of Oracle Access Manager. The scope of impact extends beyond Oracle Access Manager to other Oracle products. Exploitation can result in unauthorized creation, deletion, or modification of critical data and unauthorized access to all data accessible by Oracle Access Manager. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impact without availability impact. Oracle has issued patches in the September 2026 Critical Security Patch Update to address this vulnerability.

Successful exploitation allows attackers to gain unauthorized creation, deletion, or modification access to critical data within Oracle Access Manager and potentially other Oracle products. It also permits unauthorized access to all data accessible by Oracle Access Manager, compromising confidentiality and integrity. The vulnerability does not impact availability. The CVSS score of 9.6 reflects a critical severity level.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers using affected versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Access Manager should apply the provided patches without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying security updates to mitigate exploitation risk.