EUVD-2026-46742
GHSA-c87v-4927-334g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach OAM HTTP endpoint over network
-
DeliverySend crafted request to Authentication Engine
-
ExploitBypass authentication controls
-
ExecutionCross SSO trust boundary (scope change)
-
ImpactRead protected/critical data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against Oracle Access Manager (per AV:N/AC:L/PR:N/UI:N), affecting versions 12.2.1.4.0 and 14.1.2.1.0. The practical limiting factor is network reachability of the OAM Authentication Engine HTTP endpoint: deployments that expose OAM only on tightly segmented internal networks or behind a VPN/allowlisting reverse proxy materially reduce reachable attack surface. Exploitation targets the Authentication Engine component specifically, and impact is confined to confidentiality (data disclosure) - integrity and availability are not affected - though the scope change means disclosed data may belong to products beyond OAM. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6) describes an easily exploitable, remote, unauthenticated, no-user-interaction confidentiality breach with a scope change - a genuinely high-priority profile for an internet- or intranet-exposed SSO gateway, because compromise of an authentication broker can cascade into the applications it protects. Countervailing signals temper urgency: there is no public exploit identified at time of analysis, no CISA KEV listing (so no confirmed active exploitation), and no EPSS score was provided in the input, so exploitation probability cannot be quantified from the data given. Integrity and availability are explicitly not impacted (I:N/A:N), so this is a data-exposure risk rather than a takeover or denial-of-service risk. Net: treat as a high-priority patch given the unauthenticated/network profile and SSO blast radius, while noting that no evidence of in-the-wild use exists yet. |
| Exploit ScenarioDerived | An attacker with network reach to the OAM HTTP interface - no credentials or user interaction needed - sends crafted requests to the Authentication Engine to bypass authentication and read data they should not have access to. Because of the scope change, the attacker leverages OAM's SSO trust to reach data in applications that OAM protects, expanding the breach beyond OAM itself. No public exploit is identified at time of analysis, so this scenario reflects the CVSS profile rather than an observed exploit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Unauthorized data access in Oracle Access Manager (Fusion Middleware, Authentication Engine) 12.2.1.4.0 and 14.1.2.1.0 allows a remote, unauthenticated attacker to compromise confidentiality over HTTP, with a scope change that can significantly impact other Oracle products relying on it for single sign-on. Tagged as an Authentication Bypass, the flaw carries a CVSS 3.1 score of 8.6 and is addressed in the Oracle Critical Patch Update of July 2026. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
Apply the fixes in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to the affected Oracle Access Manager releases 12.2.1.4.0 and 14.1.2.1.0 - Patch available per vendor advisory; the exact patched build should be taken directly from the CPU matrix for your version. Until patching is complete, reduce exposure by restricting network reachability of the OAM authentication endpoints: place OAM behind a VPN or IP allowlist, terminate untrusted HTTP access at a reverse proxy or WAF, and limit inbound access to only the application tiers and administrators that require it, accepting that tightening access may disrupt external SSO flows and federated partners. Because the flaw is unauthenticated over HTTP, network-layer restriction is the most reliable compensating control until Oracle's patch is deployed; monitor OAM authentication logs for anomalous access to protected resources in the interim.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Access Manager (OAM) is the web access management and single sign-on (SSO) component of Oracle Fusion Middleware, brokering authentication and session tokens for downstream enterprise applications. The defect lies specifically in the Authentication Engine and is characterized by the vendor as enabling an unauthenticated network attacker to reach protected data. The vendor did not assign a CWE (CWE: N/A), but the 'Authentication Bypass' tag combined with the scope-change (S:C) and pure confidentiality impact (C:H, I:N, A:N) is consistent with a weakness that lets an attacker bypass or subvert authentication decisions to read data across trust boundaries, affecting resources beyond OAM itself. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_access_manager, matching the SSO tier that fronts many Oracle middleware and custom applications.
Know when Oracle Access Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Unauthenticated remote HTTP access (AV:N/AC:L/PR:N/UI:N); authentication broker leaks data across trust boundaries (S:C, C:H) with no integrity or availability impact (I:N/A:N).
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).
Executive ViewAI
Oracle Access Manager (versions 12.2.1.4.0 and 14.1.2.1.0) contains an unauthenticated remote authentication bypass that allows attackers to access sensitive data and compromise your identity infrastructure without credentials. As the foundation of single sign-on for your enterprise, this vulnerability directly threatens confidentiality across all integrated applications and dependent systems. Immediate protective action is required to prevent unauthorized access to critical business operations.
No vendor-released patch identified at time of analysis. Interim mitigations include: restrict network access to affected instances via firewall or network segmentation, implement enhanced monitoring with automated alerting for anomalous authentication patterns, require multi-factor authentication on systems dependent on Access Manager where technically feasible, limit administrative access to Access Manager to trusted networks only, and document all applications relying on affected versions for rapid incident response. Maintain contingency procedures to disable affected instances if active exploitation is detected.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Oracle Access Manager
View allPrivilege escalation and takeover of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged remote atta
Authentication bypass in Oracle Access Manager (Oracle Fusion Middleware, Authentication Engine) versions 12.2.1.4.0 and
Full compromise of Oracle Access Manager 14.1.2.1.0 (Oracle Fusion Middleware) is possible through its Authentication En
Full takeover of Oracle Access Manager (Authentication Engine component) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1
Remote unauthenticated compromise of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 is possible via the Web Server Plug
Unauthenticated network exploitation of Oracle Access Manager's Authentication Engine enables partial data read and modi
Remote exploitation of Oracle Access Manager's Authentication Engine allows unauthenticated network attackers - continge
Unauthorized read and write access to Oracle Access Manager data is achievable by unauthenticated remote attackers throu
Exploit-DB