What is the CVSS score of CVE-2026-35313?

CVE-2026-35313 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Access Manager are affected by CVE-2026-35313?

Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 contain a critical privilege escalation vulnerability (CVSS 9.9) in the Authentication Engine that allows low-privileged remote attackers to…

How to fix or mitigate CVE-2026-35313?

Within 24 hours: Inventory all OAM 12.2.1.4.0 and 14.1.2.1.0 instances; implement network segmentation restricting OAM access to authorized administrators; enable detailed audit logging on the Authentication Engine; disable HTTP access if HTTPS is available. Within 7 days: Contact Oracle for patch ETA and interim guidance; deploy Web Application Firewall rules blocking CVE-2026-35313 exploitation signatures; implement intrusion detection monitoring on OAM Authentication Engine; enforce multi-factor authentication on all applications dependent on OAM for SSO. Within 30 days: Apply vendor patch immediately upon release; if no patch timeline is provided, develop migration plan to replace or retire affected OAM versions; conduct forensic review of federated application access logs for unauthorized modifications.

Oracle Access Manager CVE-2026-35313

EUVD-2026-37439 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Oracle Access Manager Oracle Corporation

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

HTTP-reachable component (AV:N), Oracle states easily exploitable (AC:L), requires a low-privileged OAM account (PR:L), no user interaction, and OAM takeover cascades to protected apps (S:C, C/I/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:40 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Privilege escalation and takeover of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged remote attacker to fully compromise the identity broker via the Authentication Engine component, with a CVSS 9.9 score reflecting a scope-changing impact on downstream protected applications. No public exploit identified at time of analysis, but Oracle's June 2026 Critical Patch Update flags it as easily exploitable over HTTP, making it a high-priority patch for any environment using OAM for SSO/federation.

Technical ContextAI

Oracle Access Manager is the SSO, web access control, and federation hub of Oracle Fusion Middleware, brokering authentication for downstream Oracle and third-party applications via HTTP/HTTPS. The flaw resides in the Authentication Engine, the core subsystem that processes credential submissions and issues session artifacts (OAM_ID cookies, OAM tokens) consumed by WebGates and OAM agents. The CPE cpe:2.3:a:oracle_corporation:oracle_access_manager covers the affected 12c (12.2.1.4.0) and 14c (14.1.2.1.0) release trains. No CWE has been assigned, but the scope-change behavior strongly suggests an authentication or session-handling weakness whose abuse lets the attacker issue or hijack tokens trusted by other components - a class typically aligned with CWE-287 (Improper Authentication) or CWE-863 (Incorrect Authorization).

RemediationAI

Apply the patches bundled in Oracle's June 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspujun2026.html) for Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 - this is the only vendor-released fix. If immediate patching is not possible, restrict network reachability of the OAM admin and runtime HTTP endpoints to known administrative networks and SSO consumers via WAF or perimeter ACLs, tighten OAM account provisioning so low-privileged accounts cannot be self-registered, and increase monitoring of OAM session issuance and authentication-engine logs for anomalous token grants. These compensating controls reduce exposure but do not eliminate risk for users who can already authenticate, and tightening external reachability may break legitimate federation partners, so validate downstream impact before enforcing.