Oracle Access Manager CVE-2026-61067

Exploitation requires the attacker to have access to the physical communication segment (adjacent network, AV:A) attached to the hardware where Oracle Access Manager runs - remote internet-only access is insufficient - and to already hold low-level privileges (PR:L), so this is not an unauthenticated remote bug. The specific affected component is the OAM Authentication Engine, and only supported versions 12.2.1.4.0 and 14.1.2.1.0 are named as vulnerable. Limiting factors that reduce realistic risk: the adjacency requirement means proper network segmentation blocks the attack, and the required pre-existing privilege raises the bar above a purely anonymous attacker; no special product feature or non-default configuration is cited as a prerequisite, so default OAM deployments on those versions are affected once the attacker meets the access and privilege conditions.

The CVSS 3.1 vector (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.0 High) is internally consistent and is the dominant signal here: attack complexity is low and no user interaction is needed, but exploitation requires adjacency (AV:A) - access to the physical communication segment attached to the OAM host - plus low-level existing privileges (PR:L). Those two constraints materially limit real-world reach compared with a network-facing (AV:N) unauthenticated bug, so despite the 'easily exploitable' language this is not a mass-internet-scannable issue. No EPSS score, no SSVC decision, and no CWE were supplied, so automatability and technical-impact framing must be inferred rather than confirmed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, indicating no confirmed active exploitation; the risk is best characterized as high-impact-but-access-gated, warranting prompt patching for internet-adjacent or multi-tenant OAM deployments while being lower priority for well-segmented internal ones.

An attacker who has gained a low-privileged foothold on a host sharing the same network segment as the Oracle Access Manager server sends crafted traffic to the Authentication Engine. Exploiting the flaw with low complexity and no user interaction, they harvest or manipulate authentication data to seize full control of OAM, then issue trusted sessions to impersonate any user across every application OAM protects. No public proof-of-concept has been identified at time of analysis.