Threats Tagged 'cve-2026-35261'

CVE-2026-35261 is a vulnerability in Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 that allows an unauthenticated attacker with network access via HTTP to perform unauthorized read and write operations on accessible data. The vulnerability affects the Authentication Engine component of Oracle Fusion Middleware. It has a CVSS 3.1 base score of 6.5, indicating a medium severity level. Successful exploitation can lead to unauthorized update, insert, or delete access to some data, as well as unauthorized read access to a subset of data. Oracle has included this vulnerability in its June 2026 Critical Security Patch Update advisory, which contains patches for affected products. Customers are strongly advised to apply the security patches promptly to mitigate the risk. No specific patch version is explicitly stated for Oracle Access Manager in the provided advisory content, but the vendor strongly recommends applying the Critical Security Patch Update. Workarounds include blocking network protocols required by the attack or removing unnecessary privileges, though these may impact functionality.