Threats tagged 'ghsa-xfr2-j99q-c42c'

A critical vulnerability exists in Oracle Access Manager's Authentication Engine affecting versions 12.2.1.4.0 and 14.1.2.1.0. This vulnerability allows a low-privileged attacker with network access via HTTP to compromise the system, potentially leading to unauthorized creation, deletion, or modification of critical data, unauthorized access to all accessible data, and partial denial of service. The vulnerability has a CVSS 3.1 base score of 9.9, indicating severe confidentiality, integrity, and availability impacts. Oracle has released security patches addressing this issue as part of its September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk.