EUVD-2026-37440Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify OAM WebGate-protected endpoint
-
DeliverySend crafted HTTP request to plugin
-
ExploitTrigger flaw in Web Server Plugin
-
ExecutionGain partial read/write to OAM data
-
ImpactDegrade OAM availability for SSO consumers
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only network HTTP reachability to an Oracle Access Manager Web Server Plugin (WebGate) deployment running version 12.2.1.4.0 or 14.1.2.1.0; no authentication, no user interaction, and no special non-default configuration are called out in the description (PR:N/UI:N/AC:L). Limiting factors: the target host must actually run WebGate (not just OAM server components), the attacker must reach the HTTP listener (so internal-only or VPN-fronted deployments are less exposed than internet-facing SSO portals), and impact is bounded to partial read/write of OAM-accessible data and partial DoS rather than full system takeover. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L = 7.3) describes a network-reachable, low-complexity, unauthenticated flaw with partial impact across all three CIA dimensions - a strong real-world risk profile for an internet-exposed identity component, since OAM/WebGate is typically the front door to enterprise SSO. EPSS and SSVC data were not provided in the input, so quantitative exploitation probability and automatability cannot be cited. The CVE is not listed in CISA KEV and no POC is referenced, so this is not yet confirmed actively exploited; however, Oracle Access Manager has a history of being targeted (e.g. CVE-2021-35587 reached KEV), and any internet-exposed WebGate should be treated as a priority patching target. There is no conflicting signal between the description and the vector - both consistently describe easy, unauthenticated, network-based exploitation with partial (not total) impact. |
| Exploit ScenarioDerived | An external attacker enumerates an organization's SSO entry point, identifies an OAM-protected web application by its WebGate redirect, and sends crafted HTTP requests directly to the WebGate-fronted endpoint without any credentials. The requests exploit the Web Server Plugin to read, modify, or delete a subset of OAM-accessible data and to degrade the OAM service, undermining SSO availability for downstream applications. No public exploit is identified at time of analysis, but the AV:N/AC:L/PR:N/UI:N vector means weaponization is straightforward once technical details are published. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 16, 2026
Remote unauthenticated compromise of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 is possible via the Web Server Plugin component over HTTP, allowing attackers to alter or read subsets of OAM data and trigger partial denial of service. The flaw carries a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N) and is rated easily exploitable by Oracle. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.
RemediationAI
Apply the fixes from the Oracle Critical Patch Update June 2026 (https://www.oracle.com/security-alerts/cspujun2026.html) to OAM 12.2.1.4.0 and 14.1.2.1.0 deployments, including the Web Server Plugin (WebGate) binaries on every front-end HTTP server - patching only the OAM server tier is insufficient because the vulnerable component is the plugin. Exact patched build numbers are published in the Oracle CPU advisory and the matching My Oracle Support patch notes; cite those rather than any inferred version. As compensating controls until the CPU is deployed, restrict HTTP access to WebGate-protected endpoints to known client networks via WAF or network ACLs, place the OAM web tier behind a reverse proxy that strips or normalizes malformed HTTP requests, and increase monitoring on WebGate/OHS logs for anomalous request patterns and 5xx spikes; note that WAF normalization can break legitimate SSO flows that rely on custom headers, and network ACLs are not viable for public-facing portals.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Access Manager is the enterprise authentication and single sign-on (SSO) product within Oracle Fusion Middleware, used to broker access to web applications, portals, and federated services. The affected component is the Web Server Plugin (WebGate), which is installed on front-end HTTP servers (Apache OHS, IIS, etc.) to intercept requests and enforce OAM authentication policies before traffic reaches protected applications. Because the plugin sits in the request path and parses HTTP traffic on behalf of OAM, a defect there is directly reachable by anyone who can issue HTTP requests to the protected web tier. The CWE is not assigned in the input, but the impact profile (limited C/I/A with partial DoS via HTTP) is consistent with an input-handling or request-parsing weakness in the plugin rather than full auth bypass or RCE.
Know when Oracle Access Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
WebGate is reachable over HTTP with no auth or user interaction (AV:N/AC:L/PR:N/UI:N); description limits impact to subset read, partial write, and partial DoS, so C:L/I:L/A:L and S:U.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Web Server Plugin). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Access Manager accessible data as well as unauthorized read access to a subset of Oracle Access Manager accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Access Manager. CVSS 3.1 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
Executive ViewAI
Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 are vulnerable to unauthenticated remote compromise via the Web Server Plugin component, allowing attackers to read and modify access control data without credentials. Organizations relying on this identity management solution face immediate risk of unauthorized access escalation and data exposure across all protected applications. No public exploit identified at time of analysis, but the vulnerability is easily exploitable and directly threatens authentication and authorization infrastructure.
No vendor-released patch identified at time of analysis. Implement: (1) strict network segmentation restricting access to OAM Web Server Plugin to authorized administrators only; (2) Web Application Firewall rules to detect and block exploitation attempts against OAM endpoints; (3) enhanced monitoring and alerting for access anomalies on OAM components; (4) operational assessment of whether OAM service can be disabled until patch availability confirmed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Oracle Access Manager
View allPrivilege escalation and takeover of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged remote atta
Authentication bypass in Oracle Access Manager (Oracle Fusion Middleware, Authentication Engine) versions 12.2.1.4.0 and
Full compromise of Oracle Access Manager 14.1.2.1.0 (Oracle Fusion Middleware) is possible through its Authentication En
Unauthorized data access in Oracle Access Manager (Fusion Middleware, Authentication Engine) 12.2.1.4.0 and 14.1.2.1.0 a
Full takeover of Oracle Access Manager (Authentication Engine component) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1
Unauthenticated network exploitation of Oracle Access Manager's Authentication Engine enables partial data read and modi
Remote exploitation of Oracle Access Manager's Authentication Engine allows unauthenticated network attackers - continge
Unauthorized read and write access to Oracle Access Manager data is achievable by unauthenticated remote attackers throu
GitHub PoC
Exploit-DB