Oracle Access Manager EUVD-2026-79329

Exploitation requires the attacker to already hold high privileges on the target Oracle Access Manager instance (PR:H), reachable over the network via HTTP against the Authentication Engine component in versions 12.2.1.4.0 or 14.1.2.1.0. No user interaction is needed (UI:N) and attack complexity is low (AC:L), but the high-privilege prerequisite is the primary limiting factor - this is realistically an insider or post-compromise privilege-abuse path rather than a remote unauthenticated break-in. The scope change means successful exploitation can extend impact to additional products integrated with OAM for identity/SSO.

This is a genuinely high-severity but access-gated flaw. The CVSS 3.1 vector (9.1, AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) is unusually well-calibrated for an Oracle CPU entry: PR:H honestly reflects that the attacker must already hold high privileges on the target, and S:C (scope change) reflects Oracle's statement that attacks 'may significantly impact additional products.' The full C:H/I:H/A:H with 'takeover' outcome is consistent. Crucially, this is NOT the pre-auth OAM takeover - its CPU sibling CVE-2026-73947 is PR:N and scores 9.8; this one requires an already-privileged actor, which sharply narrows the realistic attacker set to insiders or attackers who have already compromised a privileged OAM account. On exploitation signals, ALL secondary indicators are absent: no CISA KEV entry, no public POC, and no EPSS score published. SSVC decision data is not provided. So while the raw score is 9.1, real-world urgency is tempered by the PR:H prerequisite and the complete absence of exploitation evidence. Data conflicts to note: the CVSS says CIA impact across the board, but the single input Tag labels this 'Information Disclosure,' which understates the confirmed integrity/availability/takeover impact. CWE is N/A and Oracle's CPU page carries zero technical detail, so root cause cannot be verified.

An attacker who has already obtained high-privilege access to an Oracle Access Manager deployment (e.g., a rogue administrator or an attacker who compromised a privileged OAM/WebLogic account) sends crafted HTTP requests to the Authentication Engine to fully compromise OAM. Because of the scope change, the compromise can cascade into other integrated products relying on OAM for SSO/identity. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation.