EUVD-2026-46772
GHSA-55xr-q9c4-gj9c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach OAM HTTP endpoint over network
-
DeliverySend crafted request to Authentication Engine
-
ExploitBypass authentication unauthenticated
-
ExecutionTake over OAM server
-
ImpactPivot to protected downstream products
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against supported deployments of Oracle Access Manager (versions 12.2.1.4.0 and 14.1.2.1.0), consistent with AV:N/AC:L/PR:N/UI:N. The only prerequisite is network reachability of the OAM Authentication Engine's HTTP interface; there is no authentication, no user interaction, and no non-default configuration named in the advisory. The primary limiting factor is exposure: environments that keep OAM's HTTP endpoints off the public internet and behind restricted management networks materially shrink the attack surface, and only the two named supported versions are stated as affected. |
| Impact | Every available signal points to maximum priority. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H yields a 10.0 base score - network vector, low complexity, no privileges, no user interaction, scope change, and total confidentiality/integrity/availability loss. Oracle explicitly labels it 'easily exploitable' and warns attacks 'may significantly impact additional products,' reinforcing the scope change. Compensating for the raw score: no EPSS probability was supplied, the vulnerability is not listed in CISA KEV in the provided data, and no POC is referenced, so there is no confirmed active exploitation - meaning urgency is driven by severity and the identity-tier target rather than by observed in-the-wild use. Because OAM authenticates access to many downstream applications, a takeover is effectively a keys-to-the-kingdom event, so this should be treated as an emergency patch regardless of the missing EPSS/KEV signals. |
| Exploit ScenarioDerived | An attacker on the network sends a crafted HTTP request directly to the OAM Authentication Engine, with no credentials required, and abuses the flaw to gain control of the OAM server. Leveraging the scope change, the attacker then mints or bypasses authentication tokens to impersonate any user and pivot into the downstream applications OAM protects. No public POC is referenced at time of analysis, but the low-complexity unauthenticated profile makes reliable exploitation likely once technical details circulate. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Remote unauthenticated compromise of Oracle Access Manager (Fusion Middleware Authentication Engine) in supported versions 12.2.1.4.0 and 14.1.2.1.0 allows a network attacker to fully take over the product via HTTP with no credentials or user interaction. Oracle rates this a maximum CVSS 3.1 10.0 because the scope-changing flaw can pivot beyond OAM to impact additional products. No public exploit identified at time of analysis, but as an SSO/identity gatekeeper the impact of takeover is severe.
RemediationAI
Apply the fixes in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected 12.2.1.4.0 and 14.1.2.1.0 branches; Oracle publishes the exact patch/bundle numbers within that CPU, and an exact standalone fix version was not provided in this input, so treat the CPU July 2026 patch level as the required baseline (patch available per vendor advisory). Because this is an unauthenticated pre-auth flaw with a scope change, prioritize patching over mitigation. Until patched, reduce exposure by restricting network reachability of OAM's HTTP endpoints to trusted management/reverse-proxy networks and blocking direct internet access to the Authentication Engine, and place a WAF/reverse proxy in front to filter anomalous authentication requests - with the trade-off that overly strict filtering can break legitimate SSO logins and federation flows, so test against production authentication patterns before enforcing. After patching, rotate OAM credentials, keys, and session secrets in case of prior compromise.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Access Manager (OAM) is the enterprise web single sign-on and access-control component of Oracle Fusion Middleware, sitting in front of applications to enforce authentication and authorization policies. The flaw resides specifically in the Authentication Engine, the subsystem that validates credentials and issues sessions/tokens; a defect there lets an unauthenticated HTTP request subvert the trust boundary the whole platform depends on. Oracle did not assign a CWE (CWE: N/A), so the precise root-cause class is unstated, but the network/unauthenticated profile plus a scope change is consistent with an authentication-bypass or deserialization/injection-style defect in request handling that grants control of the server and its downstream trust relationships.
Know when Access Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Unauthenticated network HTTP attack with low complexity and no user interaction, full CIA loss, and a scope change into downstream products, matching Oracle's 10.0.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Executive ViewAI
Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 contain a critical flaw allowing unauthenticated remote takeover without user interaction via HTTP requests. Because OAM serves as the organization's centralized authentication gateway, its compromise would enable attackers to bypass identity controls enterprise-wide and access all downstream applications and systems. With CVSS 10.0 maximum severity, scope-changing impact, and no patch currently available, this represents the most urgent infrastructure risk to the organization.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict OAM network access to authorized personnel and systems only; deploy WAF signatures to block exploitation attempts; implement comprehensive audit logging with real-time alerting for OAM authentication anomalies and configuration changes; disable unnecessary OAM services and protocols; require VPN access for all administrative functions; monitor for suspicious authentication patterns and unauthorized OAM access or behavior modifications.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Access Manager
View allVulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Ra
Authentication bypass in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 lets an unauthenticated remote attacker with HT
There is a time-based blind SQL injection vulnerability in the Access Manager component before 9.18.040 and 10.x before
Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Authentication Engine).
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/
Cross-site request forgery (CSRF) vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Acce
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allow remote atta
iManager Admin Console in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to iFrame
Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.1 allow remote attackers
Privilege escalation to full takeover in Oracle Access Manager (Fusion Middleware) 12.2.1.4.0 and 14.1.2.1.0 allows a lo
Full takeover of Oracle Access Manager (OAM) is achievable by a low-privileged, authenticated attacker who can reach the
Exploit-DB