EUVD-2026-106337
GHSA-5rj7-274x-mrq3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify reachable OAM HTTP endpoint
-
ExploitSend crafted request to Authentication Engine
-
ExecutionTrigger unauthorized data access
-
ImpactExfiltrate critical OAM-protected data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 (AV:N/AC:L/PR:N/UI:N), targeting the Authentication Engine component. Limiting factors: the attacker must be able to reach the OAM authentication HTTP endpoint on the network (internet exposure or internal access), only the two named Fusion Middleware versions are stated as affected, and applying the October 2026 Oracle CPU fix removes the exposure. Impact is bounded to confidentiality (data disclosure); no integrity or availability effect is indicated. |
| Impact | This vulnerability carries a genuine, elevated priority driven primarily by its exploitability profile rather than breadth of impact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity flaw requiring no authentication and no user interaction - Oracle explicitly calls it 'easily exploitable' - which makes it an attractive target against internet-exposed or internally reachable Oracle Access Manager instances. However, the impact is confidentiality-only (C:H/I:N/A:N, scope unchanged), so the 7.5 score reflects data disclosure, not full system takeover. Several key signals are MISSING from the input: there is no EPSS exploitation-probability score, no CISA KEV listing, and no indication of public exploit code, so real-world exploitation likelihood cannot be quantified and should be treated as unproven. Additionally, the 'Authentication Bypass' tag conflicts with the CVSS vector: a true authentication bypass in an SSO/IAM product would normally yield integrity impact (I:H), yet this scores I:N - suggesting the flaw is an information-disclosure issue in the Authentication Engine rather than a credential/session bypass; verify the precise impact with Oracle before treating it as a login bypass. Net: a real priority to patch given the IAM role of OAM and the no-auth network vector, but not confirmed as actively exploited. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker with network access to an Oracle Access Manager HTTP endpoint sends a crafted request to the Authentication Engine component, causing OAM to return or expose critical data it protects. Because no authentication or user interaction is required and attack complexity is low, exploitation can be scripted against any reachable instance. No public exploit identified at time of analysis, so weaponization effort is currently unknown. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthenticated remote attackers can disclose critical data from Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 by reaching the Authentication Engine over HTTP; the issue is rated CVSS 7.5 with high confidentiality impact and no integrity or availability effect. Exploitation requires only network reachability to the OAM authentication endpoint, making internet-exposed or broadly reachable deployments the priority. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied.
RemediationAI
Patch availability is per vendor advisory: apply the Oracle October 2026 Critical Patch Update fix for Oracle Access Manager using https://www.oracle.com/security-alerts/cpuoct2026.html; the input does not specify an exact fixed build, so confirm the target version in the CPU before deployment. Until patched, restrict network access to OAM Authentication Engine HTTP endpoints to trusted proxies, VPNs, or allowlisted client networks, recognizing that this can break legitimate external SSO and authentication flows and must be validated against business use. Fronting OAM with a reverse proxy or WAF that enforces authentication and rate limits can add detection value but is not a substitute for the CPU and may introduce latency or false positives. Review OAM and upstream access logs for anomalous unauthenticated requests to authentication endpoints, and treat critical data reachable through OAM as potentially exposed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Access Manager is Oracle Fusion Middleware's authentication and single sign-on component, and the affected Authentication Engine handles authentication flows exposed over HTTP. The input assigns no CWE, but the 'Authentication Bypass' tag and the assessed vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N indicate a remotely reachable authentication weakness that lets an attacker obtain data without credentials. Impact is bounded to confidentiality per the assessed vector; no integrity or availability effect is indicated. Affected builds are 12.2.1.4.0 and 14.1.2.1.0, and no CPE strings were supplied. The exact root-cause mechanism is not disclosed in the available advisory data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Oracle states easily exploitable, unauthenticated, over HTTP (AV:N/AC:L/PR:N/UI:N); impact is unauthorized access to critical data only, so C:H with I:N/A:N and scope unchanged.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Executive ViewAI
Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 contain a high-severity data disclosure flaw that could expose sensitive authentication data to anyone who can reach the service over the network. Because OAM is often a central identity gateway, a successful compromise could undermine trust in access controls and require incident response across dependent applications. Leadership should prioritize reducing external exposure and tracking vendor remediation, as no patch is currently available.
No vendor-released patch identified at time of analysis; interim mitigations include restricting network access to the OAM Authentication Engine to trusted sources, segmenting OAM from untrusted networks, enabling and monitoring authentication endpoint logs, deploying WAF/IPS rules for anomalous requests, and reducing internet exposure until a patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB