EUVD-2026-37439Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach OAM HTTP endpoint
-
DeliveryAuthenticate with low-privileged account
-
ExploitSend crafted request to Authentication Engine
-
ExecutionEscalate to OAM administrative control
-
PersistMint or hijack SSO tokens (scope change)
-
ImpactImpersonate users across federated applications
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the Oracle Access Manager HTTP interface and a low-privileged authenticated account on the OAM tenant (CVSS PR:L), with no user interaction needed (UI:N) and low attack complexity (AC:L); the affected component is specifically the Authentication Engine in OAM 12.2.1.4.0 or 14.1.2.1.0. The principal limiting factor is therefore obtaining any valid OAM credential - trivial in environments allowing self-registration or where OAM is exposed to a large internal user population, but a meaningful barrier where OAM is segregated and accounts are tightly provisioned. No specific non-default configuration is called out by Oracle. |
| Impact | All available signals point to a high-priority issue: CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H yields 9.9, with a scope change indicating impact beyond OAM itself onto the applications it protects. PR:L means the attacker needs only a low-privileged account - typically any authenticated OAM user, which in SSO deployments can be a very low bar. EPSS and SSVC data are not provided, and KEV does not list this CVE, so there is no confirmation of active exploitation; absence of EPSS data should not be read as low risk given the trivially exploitable HTTP attack surface Oracle describes. No public POC has been observed at time of analysis, but Oracle's own classification as 'easily exploitable' combined with OAM's role as a centralized identity gateway makes this a credible target for skilled attackers shortly after the June 2026 CPU disclosure. |
| Exploit ScenarioDerived | An attacker obtains or registers a low-privileged account on an internet-reachable OAM instance, then sends crafted HTTP requests to the Authentication Engine to abuse the flaw and obtain elevated session artifacts or full administrative control of OAM. Because of the scope change, the attacker pivots from OAM takeover to forging or hijacking SSO sessions for downstream applications (Oracle E-Business Suite, PeopleSoft, custom web apps), effectively impersonating arbitrary users across the federated estate. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Privilege escalation and takeover of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged remote attacker to fully compromise the identity broker via the Authentication Engine component, with a CVSS 9.9 score reflecting a scope-changing impact on downstream protected applications. No public exploit identified at time of analysis, but Oracle's June 2026 Critical Patch Update flags it as easily exploitable over HTTP, making it a high-priority patch for any environment using OAM for SSO/federation.
RemediationAI
Apply the patches bundled in Oracle's June 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspujun2026.html) for Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 - this is the only vendor-released fix. If immediate patching is not possible, restrict network reachability of the OAM admin and runtime HTTP endpoints to known administrative networks and SSO consumers via WAF or perimeter ACLs, tighten OAM account provisioning so low-privileged accounts cannot be self-registered, and increase monitoring of OAM session issuance and authentication-engine logs for anomalous token grants. These compensating controls reduce exposure but do not eliminate risk for users who can already authenticate, and tightening external reachability may break legitimate federation partners, so validate downstream impact before enforcing.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Access Manager is the SSO, web access control, and federation hub of Oracle Fusion Middleware, brokering authentication for downstream Oracle and third-party applications via HTTP/HTTPS. The flaw resides in the Authentication Engine, the core subsystem that processes credential submissions and issues session artifacts (OAM_ID cookies, OAM tokens) consumed by WebGates and OAM agents. The CPE cpe:2.3:a:oracle_corporation:oracle_access_manager covers the affected 12c (12.2.1.4.0) and 14c (14.1.2.1.0) release trains. No CWE has been assigned, but the scope-change behavior strongly suggests an authentication or session-handling weakness whose abuse lets the attacker issue or hijack tokens trusted by other components - a class typically aligned with CWE-287 (Improper Authentication) or CWE-863 (Incorrect Authorization).
Know when Oracle Access Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
HTTP-reachable component (AV:N), Oracle states easily exploitable (AC:L), requires a low-privileged OAM account (PR:L), no user interaction, and OAM takeover cascades to protected apps (S:C, C/I/A:H).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Executive ViewAI
Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 contain a critical privilege escalation vulnerability (CVSS 9.9) in the Authentication Engine that allows low-privileged remote attackers to fully compromise the identity broker and gain control over downstream federated applications. No public exploit identified at time of analysis, but the vulnerability is easily exploitable over HTTP. No vendor-released patch identified at time of analysis, requiring immediate containment of OAM systems that support SSO and federation services.
Implement network segmentation restricting OAM Authentication Engine access to authorized personnel only; disable HTTP and enforce HTTPS-only communication; deploy Web Application Firewall rules blocking exploitation attempts against CVE-2026-35313; enable comprehensive audit logging with real-time alerting on Authentication Engine activities; implement multi-factor authentication on all downstream applications relying on OAM for SSO; restrict OAM administrative access to dedicated secure networks; disable OAM services if non-critical pending patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Access Manager
View allAuthentication bypass in Oracle Access Manager (Oracle Fusion Middleware, Authentication Engine) versions 12.2.1.4.0 and
Full compromise of Oracle Access Manager 14.1.2.1.0 (Oracle Fusion Middleware) is possible through its Authentication En
Unauthorized data access in Oracle Access Manager (Fusion Middleware, Authentication Engine) 12.2.1.4.0 and 14.1.2.1.0 a
Full takeover of Oracle Access Manager (Authentication Engine component) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1
Remote unauthenticated compromise of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 is possible via the Web Server Plug
Unauthenticated network exploitation of Oracle Access Manager's Authentication Engine enables partial data read and modi
Remote exploitation of Oracle Access Manager's Authentication Engine allows unauthenticated network attackers - continge
Unauthorized read and write access to Oracle Access Manager data is achievable by unauthenticated remote attackers throu
GitHub PoC
Exploit-DB