Oracle Access Manager CVE-2026-46812

Exploitation requires that a person other than the attacker actively interacts with a specially crafted HTTP request - for example, clicking a malicious URL or being redirected through an attacker-controlled page that initiates a login flow against the OAM Authentication Engine. The attacker requires network-level HTTP access to the OAM server (AV:N), but no authentication credentials (PR:N) and no complex preconditions (AC:L). Exploitation is constrained by: (1) the mandatory active user interaction (UI:R), which prevents automated or worm-like mass exploitation and requires attacker investment in social engineering; (2) limited data impact scope - only a subset of OAM-accessible data can be read or modified (C:L/I:L), not full system compromise; and (3) no availability impact, ruling out denial-of-service as an outcome. No non-default configuration requirement is identified in the advisory. Both affected versions are equally susceptible with no documented platform-specific restriction.

The CVSS 3.1 base score of 6.1 (Medium) accurately captures the constrained but real-world exploitability of this flaw. The AV:N/AC:L/PR:N combination means any internet-reachable OAM instance is within attacker reach with no privilege prerequisite, lowering the bar significantly. However, the UI:R requirement is a meaningful friction point - automated, large-scale exploitation is not feasible, and attackers must invest in social engineering (e.g., phishing). The S:C flag elevates the priority for organizations using OAM as an SSO hub: even C:L/I:L impacts during authentication can translate to session token manipulation or data exposure across all downstream applications under OAM's protection umbrella, a risk not fully reflected in the raw 6.1 score. No EPSS data was provided in the source intelligence, so probabilistic exploitation likelihood cannot be quantified. The absence of a CISA KEV listing and no identified public exploit code suggests this is not currently under active mass exploitation. Overall assessment: medium-priority for standalone OAM deployments, elevated priority for environments where OAM gates access to sensitive downstream systems, especially where targeted spear-phishing is a credible threat actor TTP.

An attacker targeting an organization's Oracle Access Manager deployment crafts a malicious HTTP URL that abuses the Authentication Engine component - likely injecting payload into a login-flow parameter - and delivers it to an internal user via a phishing email or a compromised web page. When the victim clicks the link and the authentication interaction is triggered, the attacker's payload executes, reading a subset of OAM-accessible data and, due to the scope change, potentially manipulating session state or data in downstream applications protected by OAM's SSO. No public proof-of-concept has been identified, so this scenario is derived from the CVSS vector characteristics rather than confirmed observed exploitation techniques.