EUVD-2026-106379
GHSA-m5hf-f8cr-8px8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach OAM Authentication Engine over HTTP
-
DeliverySend crafted unauthenticated request
-
ExploitBypass authentication logic
-
ExecutionGain read/write access to protected data
-
ImpactPivot to OAM-trusting downstream applications
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0, targeting the Authentication Engine component (AV:N/AC:L/PR:N/UI:N confirms no authentication, no user interaction, and low complexity). The primary limiting factor is exposure: the OAM authentication endpoint must be reachable by the attacker (network-facing or reachable from a compromised segment), and only the two named versions are stated as affected, so unaffected or patched OAM builds are not exploitable. No vulnerable configuration flag is called out in the description, implying default deployments are exploitable. |
| Impact | This is a genuine top-priority vulnerability, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) scores a maximum 10.0, driven by remote, low-complexity, unauthenticated exploitation combined with a scope change - the vulnerability in Oracle Access Manager (OAM) can impact additional downstream products, which is expected since OAM is a central authentication/SSO broker whose compromise cascades to every application relying on it. The 'Authentication Bypass' tag aligns with the affected component (Authentication Engine) and the PR:N/high-C/high-I profile. No EPSS score, CISA KEV listing, or public POC is provided in the input, so exploitation-in-the-wild cannot be asserted; the signals here are entirely severity-based (CVSS + component criticality) rather than exploitation-based. The absence of an availability impact (A:N) is consistent with a data-disclosure/manipulation and auth-bypass flaw rather than a denial-of-service. Given that OAM gates access to protected enterprise resources, defenders should treat this as critical and patch on Oracle's October 2026 CPU cycle despite the lack of confirmed active exploitation. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker sends crafted HTTP requests to the OAM Authentication Engine endpoint to bypass authentication and gain unauthorized read and write access to protected data. Because OAM is a scope-crossing SSO broker, the attacker can then pivot to impersonate users and reach downstream applications that trust OAM for authentication. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Unauthenticated remote attackers can compromise Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 through the Authentication Engine, obtaining high-impact confidentiality and integrity access and potentially affecting other products because the CVSS scope is changed. The CVSS 3.1 base score is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N), with no availability impact; no public exploit identified at time of analysis. Exposure depends on reachability of the OAM authentication endpoint, and default deployments appear exploitable because the description calls out no special configuration prerequisite.
RemediationAI
The provided data does not state an exact fixed build; the primary remediation is to obtain and apply the Oracle Access Manager update from the Oracle October 2026 Critical Patch Update advisory (https://www.oracle.com/security-alerts/cpuoct2026.html) for the affected 12.2.1.4.0 and 14.1.2.1.0 deployments. Until patched, restrict network reachability to OAM Authentication Engine endpoints so only trusted proxies, load balancers, and administrative networks can connect; placing OAM behind an access-controlled reverse proxy or WAF and blocking direct Internet access reduces exposure but can disrupt federated SSO and legitimate remote login if allowlists are too narrow. Review OAM and integrated-application logs for anomalous authentication, session creation, and data modification, and validate that downstream applications do not implicitly trust OAM-issued assertions without additional authorization checks; these monitoring and trust-boundary controls are compensating measures, not substitutes for the vendor patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Access Manager is part of Oracle Fusion Middleware and provides authentication, single sign-on, and access policy enforcement for integrated applications; the affected Authentication Engine handles login and authentication processing. The provided data does not include a CWE or a detailed root-cause write-up, but the Authentication Bypass tag and the unauthenticated network vector (PR:N) indicate that an attacker can interact with the authentication workflow without valid credentials. AV:N/AC:L/UI:N means the attack is remote, low-complexity, and requires no user interaction; S:C means a compromise can cross a security boundary and affect resources beyond OAM itself, so downstream applications trusting OAM assertions or sessions should be considered in impact analysis. Only versions 12.2.1.4.0 and 14.1.2.1.0 are listed as affected by the vendor and EUVD data, and no CPE identifiers were supplied. The Oracle October 2026 Critical Patch Update advisory is the vendor reference.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Unauthenticated remote HTTP exploitation (AV:N/AC:L/PR:N/UI:N); OAM auth-broker compromise crosses scope (S:C) with high confidentiality and integrity loss but no availability impact.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Access Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).
Executive ViewAI
Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 present a critical risk to the organization's identity infrastructure because an attacker could gain high-impact access to protected systems and data through the Authentication Engine. This affects employees, partners, and customers who rely on centralized authentication, and a compromise could undermine trust and disrupt business operations. Although no public exploit identified at time of analysis, the absence of a vendor-released patch and the default-exploitable nature make this a top remediation priority for leadership.
No vendor-released patch identified at time of analysis; interim mitigations include restricting network access to Oracle Access Manager authentication endpoints, deploying WAF virtual patching, enabling enhanced logging and monitoring, segmenting affected instances, enforcing least privilege, and reviewing Oracle advisory for workarounds.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB