EUVD-2026-47277
GHSA-v25v-j57p-xvpv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach OAM authentication endpoint over HTTP
-
DeliverySend crafted request to Authentication Engine
-
ExploitBypass/subvert authentication
-
ExecutionGain administrative takeover of OAM
-
ImpactForge sessions and pivot to downstream apps
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against supported deployments of Oracle Access Manager (12.2.1.4.0 and 14.1.2.1.0) via the Authentication Engine component, per CVSS AV:N/AC:L/PR:N/UI:N. The only prerequisites are network reachability of the OAM authentication/login HTTP endpoints and that the target runs one of the two affected versions; there is no requirement for authentication, valid credentials, user interaction, or a non-default configuration. Realistic limiting factors are therefore purely network-exposure based: OAM instances isolated behind VPNs, IP allowlists, or WAFs that block untrusted access to the Authentication Engine are not reachable by an unauthenticated internet attacker. |
| Impact | All quantitative signals point to genuine high priority rather than an inflated score: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) means remote, no authentication, no user interaction, low attack complexity, and total confidentiality/integrity/availability loss, which Oracle reinforces by labeling it 'easily exploitable' and describing 'takeover.' Counterbalancing this, no EPSS score, no POC, and no CISA KEV entry appear in the provided data, so there is currently no evidence of in-the-wild or automated exploitation - the risk is high-potential but not yet demonstrated. The absence of a CWE and any technical write-up limits detection engineering, but because OAM is a pre-authentication identity gateway, a successful attack compromises the trust anchor for downstream applications, so the practical blast radius is severe and this should be treated as an urgent patch despite the missing EPSS/POC signals. |
| Exploit ScenarioDerived | An attacker with only network access to the OAM login/authentication endpoints sends a specially crafted HTTP request to the Authentication Engine, requiring no credentials and no user interaction. The request subverts authentication to grant administrative control (takeover) of OAM and, by extension, the ability to forge sessions or tokens for every application relying on it. No public exploit code is identified at this time, but the low complexity means weaponization would be straightforward once details emerge. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Full compromise of Oracle Access Manager is possible when an unauthenticated attacker sends crafted HTTP requests to the Authentication Engine component of affected Oracle Fusion Middleware deployments (12.2.1.4.0 and 14.1.2.1.0). The flaw is rated CVSS 9.8 and, per Oracle, is 'easily exploitable,' resulting in complete takeover of the identity/access layer. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, no-authentication profile makes it a high-priority patch for any Oracle SSO estate.
RemediationAI
Apply the fixes from the Oracle Critical Patch Update of July 2026 (patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships OAM security fixes as CPU bundle patches rather than a single tagged release, so identify and apply the corresponding CPU patch for your exact 12.2.1.4.0 or 14.1.2.1.0 install through My Oracle Support. Because the exact patched build number is not stated in the provided data, verify the correct patch ID against the CPU advisory before scheduling. Until patched, reduce exposure by restricting network reachability of the OAM Authentication Engine endpoints - place OAM admin/login interfaces behind a VPN or IP allowlist and terminate untrusted traffic at a WAF/reverse proxy so only expected authentication flows reach the server; note this can break federation partners or external-facing SSO and remote logins, so validate legitimate access paths before enforcing. Given the pre-authentication nature, monitor OAM access logs for anomalous requests to authentication endpoints as a compensating detection control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Access Manager (OAM) is Oracle Fusion Middleware's enterprise access management and web single sign-on (SSO) platform, fronting authentication and session management for many downstream applications. The vulnerability resides specifically in the Authentication Engine - the subsystem that validates credentials and issues sessions/tokens - which is exactly the component whose compromise cascades to every relying application. Oracle did not assign a CWE (CWE: N/A) and does not disclose the root-cause class in its Critical Patch Update format, so the precise weakness (for example authentication bypass, injection, or deserialization) cannot be confirmed from the available data; the CVSS profile of network, low-complexity, unauthenticated access with full C/I/A impact is consistent with a pre-authentication bypass or remote code execution in the engine.
Know when Access Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Oracle confirms unauthenticated network HTTP exploitation with low complexity and full takeover, so AV:N/AC:L/PR:N/UI:N with high C/I/A.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Access Manager (Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0) faces a critical vulnerability enabling unauthenticated attackers to achieve complete administrative control of the authentication and authorization infrastructure (CVE-2026-61065, CVSS 9.8). Exploitation would allow attackers to bypass authentication entirely, impersonate any user, and control all access entitlements organization-wide, effectively disabling identity governance. No vendor patch is available, requiring immediate implementation of compensating security controls.
Restrict network access to Oracle Access Manager Authentication Engine to known administrative and federated partner IP ranges only; enable detailed audit logging of all authentication requests and configuration changes; implement real-time monitoring for exploitation attempts and anomalous login patterns; maintain encrypted offline backups of identity and access control configurations; establish 24/7 security operations monitoring; prepare incident response procedures for authentication system compromise scenarios.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Access Manager
View allVulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Ra
Authentication bypass in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 lets an unauthenticated remote attacker with HT
There is a time-based blind SQL injection vulnerability in the Access Manager component before 9.18.040 and 10.x before
Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Authentication Engine).
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/
Cross-site request forgery (CSRF) vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Acce
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allow remote atta
Remote unauthenticated compromise of Oracle Access Manager (Fusion Middleware Authentication Engine) in supported versio
iManager Admin Console in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to iFrame
Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.1 allow remote attackers
Privilege escalation to full takeover in Oracle Access Manager (Fusion Middleware) 12.2.1.4.0 and 14.1.2.1.0 allows a lo
Exploit-DB