Oracle Access Manager EUVD-2026-46554

Exploitation requires that a person other than the attacker actively interacts with the malicious HTTP request - most likely by clicking an attacker-crafted link or visiting a page that issues the request on their behalf (UI:R is mandatory per the CVSS vector). The attacker requires no authentication (PR:N) and no special network position beyond standard HTTP access to the OAM authentication endpoint. The vulnerability is present in default-supported deployments of OAM 12.2.1.4.0 and 14.1.2.1.0 with no non-default configuration required. Exploitation is limited to the confidentiality and integrity planes (C:L/I:L); no availability impact is possible. The human interaction requirement prevents fully automated, worm-style propagation. Environments where the OAM authentication portal is not internet-facing reduce attacker reach but do not eliminate insider or phishing-driven risk vectors.

The CVSS 3.1 base score of 6.1 (Medium) reflects a meaningful but bounded risk profile: network-accessible (AV:N), low complexity (AC:L), no required privileges (PR:N), but dependent on victim interaction (UI:R), with limited confidentiality and integrity impact (C:L/I:L/A:N). The scope change (S:C) is the most significant amplifying factor - OAM acting as an SSO gateway means exploitation could affect all applications federating authentication through it, not just OAM itself. No EPSS score was provided in the source data, so probabilistic exploitation likelihood cannot be quantified here. No CISA KEV listing and no public POC code have been identified, which reduces urgency for emergency patching but does not eliminate risk given OAM's position in identity infrastructure. The UI:R requirement is a meaningful limiting factor: mass exploitation is infeasible without a social engineering component. Environments using OAM as the authentication front-end for sensitive internal applications should treat this as elevated priority despite the moderate base score, given the scope change potential.

An attacker crafts a malicious URL targeting Oracle Access Manager's login or authentication redirect endpoint, embedding a reflected payload in a query parameter processed by the Authentication Engine. The attacker delivers this URL to a legitimate OAM user via phishing email or a compromised third-party site; when the victim clicks the link and their browser processes the authentication response, the injected content executes in the context of the OAM session, potentially exfiltrating session tokens, authentication artifacts, or injecting content into downstream applications sharing the SSO scope. No public POC has been identified, but the low attack complexity (AC:L) suggests the technique would not require advanced skill once the injection point is identified.