What is the CVSS score of CVE-2026-35314?

CVE-2026-35314 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.3%.

Which versions of Oracle Access Manager are affected by CVE-2026-35314?

Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 are vulnerable to unauthenticated remote compromise via the Web Server Plugin component, allowing attackers to read and modify access control…

How to fix or mitigate CVE-2026-35314?

Within 24 hours: Identify all Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 deployments and document internet exposure; immediately restrict HTTP access to OAM Web Server Plugin if externally accessible. Within 7 days: Deploy Web Application Firewall rules blocking suspicious OAM requests; implement network segmentation to limit OAM accessibility; contact Oracle Support for patch availability and timeline. Within 30 days: Upgrade to patched Oracle Access Manager version or migrate to alternative identity management platform if Oracle confirms extended patch unavailability.

Oracle Access Manager CVE-2026-35314

EUVD-2026-37440 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Denial Of Service Oracle Oracle Access Manager Oracle Corporation

7.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

7.3 HIGH

WebGate is reachable over HTTP with no auth or user interaction (AV:N/AC:L/PR:N/UI:N); description limits impact to subset read, partial write, and partial DoS, so C:L/I:L/A:L and S:U.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:41 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Web Server Plugin). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Access Manager accessible data as well as unauthorized read access to a subset of Oracle Access Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Access Manager. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).

AnalysisAI

Remote unauthenticated compromise of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 is possible via the Web Server Plugin component over HTTP, allowing attackers to alter or read subsets of OAM data and trigger partial denial of service. The flaw carries a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N) and is rated easily exploitable by Oracle. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.

Technical ContextAI

Oracle Access Manager is the enterprise authentication and single sign-on (SSO) product within Oracle Fusion Middleware, used to broker access to web applications, portals, and federated services. The affected component is the Web Server Plugin (WebGate), which is installed on front-end HTTP servers (Apache OHS, IIS, etc.) to intercept requests and enforce OAM authentication policies before traffic reaches protected applications. Because the plugin sits in the request path and parses HTTP traffic on behalf of OAM, a defect there is directly reachable by anyone who can issue HTTP requests to the protected web tier. The CWE is not assigned in the input, but the impact profile (limited C/I/A with partial DoS via HTTP) is consistent with an input-handling or request-parsing weakness in the plugin rather than full auth bypass or RCE.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html) to OAM 12.2.1.4.0 and 14.1.2.1.0 deployments, including the Web Server Plugin (WebGate) binaries on every front-end HTTP server - patching only the OAM server tier is insufficient because the vulnerable component is the plugin. Exact patched build numbers are published in the Oracle CPU advisory and the matching My Oracle Support patch notes; cite those rather than any inferred version. As compensating controls until the CPU is deployed, restrict HTTP access to WebGate-protected endpoints to known client networks via WAF or network ACLs, place the OAM web tier behind a reverse proxy that strips or normalizes malformed HTTP requests, and increase monitoring on WebGate/OHS logs for anomalous request patterns and 5xx spikes; note that WAF normalization can break legitimate SSO flows that rely on custom headers, and network ACLs are not viable for public-facing portals.