Oracle Access Manager EUVD-2026-46770

The exploitable prerequisite is network HTTP access to an Oracle Access Manager instance running the Authentication Engine on affected versions 12.2.1.4.0 or 14.1.2.1.0 - the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no user interaction, and low complexity against reachable instances. Limiting factors that reduce realistic risk: the target OAM authentication/SSO endpoints must be network-reachable by the attacker (internal-only or VPN-gated deployments substantially shrink exposure), and only the two named supported versions are confirmed affected. The scope change (S:C) means impact is not limited to OAM itself but can extend to products that rely on it for authentication, so downstream exposure depends on which applications trust the compromised OAM instance.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6) describes an easily exploitable, network-facing, unauthenticated attack with a scope change and high confidentiality impact but no integrity or availability impact - consistent with credential/token bypass leading to data disclosure rather than destructive compromise. The scope change (S:C) is the key aggravator: OAM is an identity broker, so bypassing it can expose downstream applications, which raises real priority for internet- or intranet-exposed SSO endpoints. Countervailing signals: no EPSS score was provided, the CVE is not in CISA KEV, and no POC or in-the-wild exploitation is indicated, so this is currently a high-severity-by-vector issue without confirmed active exploitation. Missing data to note explicitly: no CWE, no EPSS, no SSVC decision, and no CPE - so automatability and technical-impact framing are inferred from the CVSS vector alone and should be verified against the Oracle July 2026 CPU advisory.

An attacker with only network reachability to the OAM HTTP endpoints sends crafted authentication requests to the Authentication Engine and obtains access without valid credentials, then reads protected data or pivots into applications that trust OAM for SSO. No user interaction or prior authentication is required per the CVSS vector, and the scope change means downstream OAM-protected resources may also be reached. No public POC is identified at time of analysis, so exploitation would currently require independent research.