Oracle Access Manager EUVD-2026-37394

No special conditions are required beyond network-level HTTP access to the Oracle Access Manager instance. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against standard deployments of Oracle Access Manager versions 12.2.1.4.0 or 14.1.2.1.0; no special configuration, feature flag, or privileged account is needed. Exploitation is limited to these two specific version strings - organizations running other versions are not confirmed affected per available data. The scope is unchanged (S:U), meaning exploitation does not automatically pivot to other systems beyond OAM itself, and there is no availability impact (A:N), so the attack does not disrupt service. The primary limiting factor for real-world blast radius is whether the OAM authentication endpoint is reachable from untrusted networks.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N establishes a moderately severe baseline - network-reachable, trivially exploitable without credentials or user interaction, but with bounded impact (partial confidentiality and integrity, no availability disruption, no scope change). The score of 6.5 may understate operational risk: OAM commonly sits in front of enterprise application portfolios as the authentication chokepoint, meaning unauthorized data modification in the Authentication Engine could affect authentication decisions, session state, or policy data for many downstream systems, even if the direct CVSS impact metrics are low. No EPSS score is provided in the available intelligence, preventing probability-based prioritization. No CISA KEV listing is present, and no public proof-of-concept has been identified, which lowers immediate exploitation urgency. EUVD-2026-37394 corroborates the Oracle advisory without adding new exploitation signals. Overall: treat as a genuine priority for internet-exposed or perimeter-accessible OAM deployments, despite the moderate CVSS, given the sensitivity of the affected component.

An unauthenticated attacker with HTTP network access to an Oracle Access Manager instance sends a specially crafted HTTP request targeting the Authentication Engine on a vulnerable 12.2.1.4.0 or 14.1.2.1.0 deployment. By exploiting the authentication bypass flaw, the attacker is able to read a subset of OAM-accessible data (such as authentication policy data or session records) and perform unauthorized insert, update, or delete operations on that data without presenting valid credentials. No public proof-of-concept has been identified, but the low attack complexity (AC:L) indicates exploitation would require no specialized tooling once the specific request pattern is understood.