Oracle Access Manager EUVD-2026-46921

The vulnerability is in the Oracle Access Manager Authentication Engine and is reachable by an unauthenticated attacker over HTTP; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no special conditions - remote unauthenticated exploitation is possible against affected Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 instances whose OAM authentication endpoints are network-reachable. The practical limiting factor is exposure: the target OAM instance must be reachable by the attacker over HTTP, so instances confined to trusted internal networks or fronted by restrictive proxies are materially harder to reach. Only the two listed supported versions are stated as affected. No authentication, no user interaction, and no non-default configuration are required by the CVSS metrics.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, base 8.6 HIGH) is a strong exploitation signal: network attack vector, low complexity, no privileges, and no user interaction mean a remote unauthenticated attacker can trigger it against exposed instances, and the scope change amplifies impact to connected products. Impact is confidentiality-only (C:H, I:N, A:N) - this is a data-exposure/access issue, not a code-execution or availability threat. No EPSS score, KEV listing, or POC was supplied, so there is no evidence of active exploitation or public weaponization at this time; the risk is currently driven by the high exploitability profile rather than confirmed in-the-wild activity. Given OAM's role as an internet-facing SSO gateway in many deployments, this should be treated as a high-priority patch despite the absence of a published exploit. No SSVC or EPSS decision data was provided to further refine automatability.

An attacker with only network access sends crafted HTTP requests to an internet-exposed Oracle Access Manager Authentication Engine and bypasses authentication, obtaining access to protected data without any credentials or user interaction. Leveraging OAM's role as an SSO trust anchor (scope change), the attacker then reaches confidential data in downstream applications that rely on OAM for access decisions. No public POC is currently identified, but the low-complexity, no-privilege vector makes reliable exploitation plausible once details emerge.