Oracle Access Manager EUVD-2026-46814

Exploitation targets the Authentication Engine component of Oracle Access Manager reachable over HTTP (AV:N), requires no authentication (PR:N) and no user interaction (UI:N), and applies to supported versions 12.2.1.4.0 and 14.1.2.1.0. The primary limiting factor is Oracle's stated High attack complexity (AC:H): the attacker must satisfy conditions outside their direct control - plausibly specific configuration, timing/race conditions, or environmental state - making reliable exploitation difficult. The other key limiter is network reachability of the OAM authentication endpoints; deployments that expose OAM only to trusted internal networks or behind restrictive ingress substantially reduce exposure. Oracle did not publish the precise configuration prerequisite, so the exact triggering condition is not confirmed from available data.

Signals are mixed and must be weighed carefully. The CVSS 3.1 base score of 8.1 (High) reflects network reachability with no privileges or user interaction (AV:N/PR:N/UI:N) and full CIA impact, but the High attack complexity (AC:H) materially lowers real-world exploitability - Oracle explicitly calls it 'difficult to exploit.' There is no EPSS score provided, no POC referenced, and no CISA KEV listing, so there is currently no evidence of active or imminent exploitation; the risk is presently theoretical-but-serious rather than urgent. Note a minor conflict in the intelligence: the vendor tag says 'Information Disclosure' while the CVSS vector and description assert full takeover (I:H/A:H) - the vector should be treated as authoritative over the tag. Because OAM is an authentication chokepoint, a successful exploit would have outsized blast radius, so despite AC:H this warrants prompt patching in the normal Oracle CPU cycle, prioritized ahead of lower-impact same-quarter fixes.

A remote attacker with no credentials sends crafted HTTP requests to an internet- or intranet-reachable Oracle Access Manager Authentication Engine endpoint, exploiting the flaw to bypass or subvert authentication logic and gain control of the OAM instance. Because OAM brokers SSO for downstream applications, the attacker could then forge sessions or tokens to pivot into protected enterprise apps. The High attack complexity means the attacker likely needs specific conditions, timing, or repeated attempts to succeed, and no public POC is currently known.