Skip to main content

Oracle Access Manager EUVDEUVD-2026-37329

| CVE-2026-46812 MEDIUM
Improper Access Control (CWE-284)
2026-06-16 oracle
Authentication Bypass Oracle Oracle Access Manager
6.1
CVSS 3.1 · Vendor: oracle
Share

Severity by source

Vendor (oracle) PRIMARY
6.1 MEDIUM
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
vuln.today AI
6.1 MEDIUM

Consistent with vendor-provided vector: network-exploitable without credentials, user interaction required, scope change reflects SSO propagation; low C/I impacts with no availability component.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None

Lifecycle Timeline

1
Analysis Generated
Jun 17, 2026 - 00:26 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Access Manager accessible data as well as unauthorized read access to a subset of Oracle Access Manager accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

AnalysisAI

Remote exploitation of Oracle Access Manager's Authentication Engine allows unauthenticated network attackers - contingent on user interaction - to achieve limited confidentiality and integrity compromise, with scope change propagating impact to additional Fusion Middleware products. Versions 12.2.1.4.0 and 14.1.2.1.0 are confirmed affected per Oracle's June 2026 Critical Patch Update. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Attacker identifies internet-facing OAM login endpoint
Delivery
Crafts malicious HTTP URL targeting Authentication Engine parameter
Exploit
Delivers URL to OAM user via phishing or social engineering
Install
Victim clicks link and interacts with authentication flow
C2
Payload executes within authentication context
Execute
Unauthorized read/modify access on OAM data achieved
Impact
Scope change propagates impact to downstream SSO-protected applications
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that a person other than the attacker actively interacts with a specially crafted HTTP request - for example, clicking a malicious URL or being redirected through an attacker-controlled page that initiates a login flow against the OAM Authentication Engine. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 base score of 6.1 (Medium) accurately captures the constrained but real-world exploitability of this flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker targeting an organization's Oracle Access Manager deployment crafts a malicious HTTP URL that abuses the Authentication Engine component - likely injecting payload into a login-flow parameter - and delivers it to an internal user via a phishing email or a compromised web page. When the victim clicks the link and the authentication interaction is triggered, the attacker's payload executes, reading a subset of OAM-accessible data and, due to the scope change, potentially manipulating session state or data in downstream applications protected by OAM's SSO. …
Remediation Apply the patches distributed in Oracle's Critical Patch Update for June 2026, referenced at https://www.oracle.com/security-alerts/cspujun2026.html, for the installed version (12.2.1.4.0 or 14.1.2.1.0). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Oracle Access Manager

View all
CVE-2026-35313 CRITICAL
9.9 Jun 16

Privilege escalation and takeover of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged remote atta
CVE-2026-35314 HIGH
7.3 Jun 16

Remote unauthenticated compromise of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 is possible via the Web Server Plug
CVE-2026-35261 MEDIUM
6.5 Jun 16

Unauthenticated network exploitation of Oracle Access Manager's Authentication Engine enables partial data read and modi

Same weakness CWE-284 – Improper Access Control

View all
CVE-2012-4681 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2012-5076 CRITICAL POC
9.8
CVE-2014-3120 HIGH POC
8.1
CVE-2013-2423 LOW POC
3.7
CVE-2016-3427 CRITICAL
9.8
CVE-2025-12480 CRITICAL POC
9.1

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

EUVD-2026-37329 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy