Oracle Access Manager EUVD-2026-79519

Exploitation requires network access to the Oracle WebLogic T3 or IIOP listener fronting the Oracle Access Manager Authentication Engine on affected versions 12.2.1.4.0 or 14.1.2.1.0; no credentials and no user interaction are needed (PR:N/UI:N). The primary limiting factor is network exposure of the T3/IIOP protocols - Oracle and security best practice is to restrict these protocols to trusted internal networks or disable/filter them, so instances where T3/IIOP is firewalled from untrusted sources are not remotely exploitable by external attackers. There is no authentication or configuration prerequisite on the attacker side beyond protocol reachability.

This is a genuinely high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes remote, network-reachable, unauthenticated, low-complexity exploitation with full compromise of confidentiality, integrity, and availability, and the Oracle description reinforces this by stating the flaw is 'easily exploitable' and results in complete 'takeover of Oracle Access Manager.' The attack vectors named - T3 and IIOP - are the WebLogic remote invocation protocols, historically the highest-risk exposure surface in Oracle Fusion Middleware because they are frequently reachable without authentication and have a long track record of deserialization-style pre-auth compromise. The CVSS/9.8 rating is therefore well-calibrated rather than inflated. However, key exploitation-maturity signals are absent from the provided data: no EPSS score, no CISA KEV listing, and no public exploit (POC) were supplied, so at time of analysis there is no confirmed active exploitation. The practical risk is strongly mitigated for organizations that follow best practice of NOT exposing T3/IIOP to untrusted networks (these protocols should be firewalled/segmented), which is the single most important limiting factor. Bottom line: treat as a critical patch priority for any internet- or broadly-network-exposed OAM/WebLogic tier, while noting exploitation status is unconfirmed.

An attacker with network reachability to the WebLogic T3 or IIOP listener of an Oracle Access Manager instance sends a crafted protocol request to the Authentication Engine component without any credentials. Exploitation requires no user interaction and low complexity, resulting in full takeover of the OAM instance (confidentiality, integrity, and availability all fully impacted). No public exploit code was identified in the provided data, but T3/IIOP pre-auth vectors in Oracle Fusion Middleware are historically weaponized quickly after disclosure.