Oracle Access Manager EUVD-2026-106326

No authentication is required (CVSS PR:N) and the attack is reachable remotely over HTTP (AV:N) against Oracle Access Manager's Authentication Engine, with no user interaction (UI:N) - on affected versions 12.2.1.4.0 and 14.1.2.1.0. The primary limiting factor is Oracle's AC:H ('Difficult to exploit') rating: successful attack depends on specific, non-trivial conditions outside the attacker's direct control (e.g., timing, environmental state, or a particular authentication flow), which Oracle does not disclose in detail - so this is not a point-and-click exploit. Realistic exposure is highest where OAM's authentication endpoints are internet- or widely-network-reachable; impact extends beyond OAM itself due to the scope change (S:C) to the downstream products and data it federates.

This is a serious but conditional risk. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N, base 8.7) shows a network-reachable, unauthenticated flaw (PR:N) in Oracle Access Manager's Authentication Engine with a scope change (S:C) and high confidentiality and integrity impact - meaning a successful compromise of this SSO/identity gatekeeper can cascade into the downstream applications and data it protects, which is why Oracle's own text warns attacks 'may significantly impact additional products.' The key tempering signal is AC:H ('Difficult to exploit'): Oracle rates this high attack complexity, implying non-trivial preconditions, timing, or reconnaissance beyond the attacker's control, so reliable weaponization is not guaranteed. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this is currently a patch-priority driven by potential impact rather than observed attacks. Net: treat as high priority for Oracle Access Manager operators because it is unauthenticated, network-facing, and sits at an identity chokepoint with scope change, but the AC:H rating and absence of exploitation/EPSS/POC signals argue against emergency same-day response unless OAM is internet-exposed. Note the 'Authentication Bypass' tag is consistent with the Authentication Engine component but is not explicitly confirmed as the mechanism in Oracle's terse description - verify against the Oracle CPU advisory.

A remote, unauthenticated attacker sends specially crafted HTTP requests to the Oracle Access Manager Authentication Engine to abuse a flaw in how authentication is processed, gaining read and write access to data OAM protects. Because OAM is a scope-changing SSO/identity broker, the attacker can pivot to the downstream applications and critical data it fronts. No public exploit code is identified at time of analysis, and the CVSS AC:H rating means exploitation requires specific conditions and is not trivially repeatable.