Oracle Access Manager EUVD-2026-46740

Exploitation requires the attacker to (1) hold low-privileged access (PR:L) to a system and (2) be positioned on the physical/adjacent communication segment attached to the hardware where Oracle Access Manager runs (AV:A) - internet-only or cross-segment attackers cannot reach it. The target must be running an affected version (12.2.1.4.0 or 14.1.2.1.0) with the Authentication Engine component in use. Limiting factors that reduce realistic risk: the adjacency requirement blocks remote internet exploitation, and the PR:L requirement means a prior credential or foothold is needed; no user interaction is required (UI:N) and complexity is low (AC:L), so once the network and privilege preconditions are met exploitation is straightforward.

This is a genuine high-severity issue (CVSS 8.0) but its real-world exposure is materially constrained by the attack vector: AV:A means the attacker must sit on the physical communication segment attached to the OAM hardware, not the open internet, and PR:L means some prior low-level access is required. That combination makes mass, remote, unauthenticated exploitation implausible and points toward an insider or lateral-movement threat model rather than a wormable internet-facing risk. Against that, AC:L (low complexity), UI:N (no user interaction), and full C/I/A impact with 'takeover' language make it a strong priority wherever the segment-adjacency precondition can be met. No EPSS score, KEV listing, POC, or SSVC data was provided, so exploitation probability cannot be quantified from the input; the absence of KEV/POC signals no confirmed active exploitation at this time. Note the Oracle 'Information Disclosure' tag conflicts with the vector's full integrity/availability impact and the 'takeover' description - treat the impact as full compromise per the CVSS vector, which is the more specific signal.

An attacker who has gained a low-privileged foothold on a server sharing the same network segment as the Oracle Access Manager host sends crafted traffic to the Authentication Engine over the adjacent link. With low attack complexity and no user interaction required, they subvert the authentication logic to fully take over OAM, gaining control over SSO trust and any application that depends on it. No public proof-of-concept is available at this time.