This vulnerability affects the Authentication Engine component of Oracle Access Manager in Oracle Fusion Middleware. It is difficult to exploit but allows a low privileged attacker with network access via HTTP to compromise Oracle Access Manager. The scope of impact extends beyond Oracle Access Manager to other Oracle products. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. Oracle has released patches for affected versions as part of their September 2026 Critical Security Patch Update.

Successful exploitation can result in complete takeover of Oracle Access Manager, compromising confidentiality, integrity, and availability of the system. Due to scope change, other Oracle products integrated with or dependent on Oracle Access Manager may also be significantly impacted.

Oracle has released security patches addressing this vulnerability in the September 2026 Critical Security Patch Update. Customers should apply these patches promptly to mitigate the risk. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.