EUVD-2026-37329Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Consistent with vendor-provided vector: network-exploitable without credentials, user interaction required, scope change reflects SSO propagation; low C/I impacts with no availability component.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Access Manager accessible data as well as unauthorized read access to a subset of Oracle Access Manager accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
AnalysisAI
Remote exploitation of Oracle Access Manager's Authentication Engine allows unauthenticated network attackers - contingent on user interaction - to achieve limited confidentiality and integrity compromise, with scope change propagating impact to additional Fusion Middleware products. Versions 12.2.1.4.0 and 14.1.2.1.0 are confirmed affected per Oracle's June 2026 Critical Patch Update. The scope change (S:C) is particularly notable because OAM functions as an SSO gateway, meaning even limited manipulation during authentication flows can cascade to downstream applications sharing that identity fabric. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Technical ContextAI
Oracle Access Manager (OAM) is an enterprise-grade identity and access management platform within Oracle Fusion Middleware, providing Single Sign-On, federation, and policy-based authorization services for web applications. The affected component is the Authentication Engine - the subsystem responsible for credential validation, session token issuance, and challenge-response processing during login flows. The CPE identifier cpe:2.3:a:oracle_corporation:oracle_access_manager:*:*:*:*:*:*:*:* confirms both the 12.2.1.4.0 and 14.1.2.1.0 release trains are in scope. The CVSS vector's S:C (Scope Changed) metric directly reflects OAM's architectural position as a trust broker: a compromised authentication endpoint can produce effects in systems that rely on OAM-issued tokens or sessions. The UI:R requirement combined with S:C and the authentication engine component is a pattern consistent with reflected injection attacks (e.g., cross-site scripting or open redirect on the login page) that execute in a victim's browser and reach beyond OAM into dependent application sessions, though Oracle has not published a CWE to confirm the exact root cause class.
RemediationAI
Apply the patches distributed in Oracle's Critical Patch Update for June 2026, referenced at https://www.oracle.com/security-alerts/cspujun2026.html, for the installed version (12.2.1.4.0 or 14.1.2.1.0). Oracle CPUs are cumulative, so applying the full update for the affected release train is the definitive fix. Exact patched version identifiers are not independently confirmed beyond the CPU advisory itself - consult Oracle My Support for the specific patch bundle applicable to your environment. As a compensating control pending patch deployment, restrict external network access to the OAM Authentication Engine endpoints (typically the OAM managed server HTTP/HTTPS listener) to trusted internal networks or VPN-only segments, eliminating the AV:N attack vector at the network layer - note this may be operationally disruptive in externally-facing deployments. Additionally, deploying a Web Application Firewall with rules targeting injection patterns on OAM login URIs may reduce exploitation likelihood but is not a substitute for patching. Organizations relying on OAM for SSO to sensitive downstream systems should treat this as higher priority than the base score alone suggests.
More in Oracle Access Manager
View allPrivilege escalation and takeover of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged remote atta
Authentication bypass in Oracle Access Manager (Oracle Fusion Middleware, Authentication Engine) versions 12.2.1.4.0 and
Full compromise of Oracle Access Manager 14.1.2.1.0 (Oracle Fusion Middleware) is possible through its Authentication En
Unauthorized data access in Oracle Access Manager (Fusion Middleware, Authentication Engine) 12.2.1.4.0 and 14.1.2.1.0 a
Full takeover of Oracle Access Manager (Authentication Engine component) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1
Remote unauthenticated compromise of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 is possible via the Web Server Plug
Unauthenticated network exploitation of Oracle Access Manager's Authentication Engine enables partial data read and modi
Unauthorized read and write access to Oracle Access Manager data is achievable by unauthenticated remote attackers throu
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today