EUVD-2026-106324
GHSA-h5pr-6363-c2vw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed OAM endpoint
-
DeliverySend crafted HTTP request to Authentication Engine
-
ExploitBypass authentication controls
-
ExecutionRead OAM-protected data and tamper partially
-
ImpactExfiltrate data / cause partial DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation targets the Authentication Engine component of Oracle Access Manager reachable over HTTP; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special non-default configuration are stated as prerequisites, so a network-reachable OAM instance of version 12.2.1.4.0 or 14.1.2.0.0 is the primary requirement. The principal limiting factor is network exposure: OAM deployments restricted to internal/management networks or behind a WAF/reverse proxy that filters the vulnerable endpoint materially reduce reachability, and only the two named versions are confirmed affected, so environments on other patched builds are out of scope. |
| Impact | This is a genuine high priority based on the exploitability signals, not merely a high-CVSS-but-low-risk issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, low-complexity, unauthenticated exploitation requiring no user interaction - Oracle itself rates it 'easily exploitable,' which aligns with AC:L. The impact profile (C:H/I:L/A:L) means the core consequence is a confidentiality breach (complete read access to OAM-protected data), with secondary partial integrity and availability impact. Critically, this flaw sits in the Authentication Engine of an identity/SSO gateway, so compromise can cascade into downstream applications that trust OAM for authentication. Mitigating/limiting signals: no EPSS score is provided in the input, this CVE is NOT on CISA KEV, and no public POC is referenced, so there is no evidence of active or automated exploitation yet. The key tension to flag: ease-of-exploitation ratings are vendor-asserted (Oracle 'easily exploitable') while independent exploitation-probability (EPSS) and in-the-wild data are absent - treat exploitation likelihood as elevated-but-unconfirmed rather than proven. Given the product class and unauthenticated network vector, defenders should prioritize patching even absent KEV/POC signals. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends crafted HTTP requests to an internet- or network-exposed Oracle Access Manager Authentication Engine endpoint, abusing the flaw to bypass authentication controls and read sensitive OAM-protected data, with limited ability to modify data and degrade service. No user interaction or credentials are required (AV:N/PR:N/UI:N), making opportunistic scanning of exposed OAM instances a realistic delivery method. No public exploit code is identified at time of analysis, so exploitation currently requires attacker-developed tooling. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthenticated network attackers can compromise the Authentication Engine component of Oracle Access Manager 12.2.1.4.0 and 14.1.2.0.0 over HTTP, gaining high-confidentiality read access to data managed by the identity server plus limited ability to modify it and to degrade availability (CVSS 3.1 base 8.6, AV:N/AC:L/PR:N/UI:N). Because the vector carries PR:N and UI:N, no credentials, session, or victim interaction are needed - only network reachability to a vulnerable OAM deployment. No public exploit code or confirmed active exploitation was identified at time of analysis, so risk is driven by exposure: internet-facing or broadly reachable OAM instances should be treated as high priority and patched via Oracle's October 2026 Critical Patch Update, while internal-only deployments behind filtering proxies have materially lower reachability.
RemediationAI
Apply the fix from Oracle's October 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the vendor channel for OAM 12.2.1.4.0 and 14.1.2.0.0; the input data does not name an exact post-patch build number, so confirm the CPU-applied bundle level against the advisory before closing the finding. Until patched, reduce reachability to the Authentication Engine: restrict the OAM HTTP endpoints to trusted source ranges or place them behind a reverse proxy/WAF that filters malformed pre-authentication requests - the trade-off is that legitimate remote and partner users lose direct access and must traverse the proxy, and overly tight WAF rules can break SSO redirects and agent heartbeats. If the deployment permits it, terminate external authentication at an alternate gateway or shift internet-facing applications to an unaffected OAM build; this limits exposure but does not remove the vulnerable code path from the estate. Enable verbose audit logging on OAM authentication endpoints and alert on anomalous pre-auth request patterns and unexpected session issuance, accepting the extra log volume and storage cost, and plan a short remediation window rather than relying on detection alone given the pre-authentication, low-complexity nature of the flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Access Manager is the SSO and identity/access-management tier of Oracle Fusion Middleware, and the affected component is its Authentication Engine - the subsystem that terminates HTTP requests from browser and agent clients, evaluates authentication schemes, and issues OAM session tokens and cookies. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U with C:H/I:L/A:L describes a pre-authentication defect in that request-handling path: an attacker who can reach the engine over HTTP can obtain high-confidentiality access to OAM-accessible data, perform limited unauthorized insert/update/delete operations, and trigger a partial denial of service - the classic footprint of an authentication-bypass or session/assertion-handling flaw that lets a crafted request be processed as though it came from an authenticated principal. Community tags classify the issue as both an authentication bypass and a denial-of-service condition, which is consistent with the C/I/A split in the vendor score. No CWE was assigned in the source data, but the impact profile maps to access-control/authentication-decision weaknesses (CWE-287/CWE-306 family) rather than memory corruption, since the vector shows no scope change and low attack complexity. Only two releases are confirmed affected - 12.2.1.4.0 and 14.1.2.0.0 - per Oracle's advisory and ENISA EUVD (EUVD-2026-106324).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Vendor confirms easy unauthenticated HTTP exploitation (AV:N/AC:L/PR:N/UI:N); impact is high confidentiality with partial integrity and availability (C:H/I:L/A:L), scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Access Manager accessible data as well as unauthorized update, insert or delete access to some of Oracle Access Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Access Manager. CVSS 3.1 Base Score 8.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L).
Executive ViewAI
Oracle Access Manager 12.2.1.4.0 and 14.1.2.0.0 carry a high-severity flaw in the Authentication Engine that allows an unauthenticated network attacker to read large volumes of the identity data the identity server manages, make limited modifications to it, and degrade availability. Because OAM is usually the trust anchor for single sign-on, the exposure is not confined to the identity team - every application that relies on OAM for authentication and authorization decisions inherits the risk. No public exploit identified at time of analysis, so prioritization should follow network exposure: internet-facing or broadly reachable deployments demand immediate attention, while internal-only instances behind filtering proxies carry materially lower risk.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network reachability to OAM Authentication Engine endpoints via firewall allowlists and segmentation so only trusted proxies and client ranges can connect; front internet-facing deployments with a filtering reverse proxy or WAF; eliminate external exposure of administrative and diagnostic interfaces; enforce least-privilege on the identity data that OAM can read or write; enable verbose authentication and data-access logging with alerting on anomalous read volume or modification; review identity stores for unauthorized changes and monitor for indicators of identity-data harvesting; prefer internal-only deployment topologies behind filtering proxies until the October 2026 Critical Patch Update is available and applied.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB