Oracle Access Manager EUVD-2026-79523

Exploitation requires only network HTTP access to an Oracle Access Manager instance running affected version 12.2.1.4.0 or 14.1.2.1.0 (component: Authentication Engine); per CVSS PR:N/UI:N/AC:L it needs no authentication, no user interaction, and no special configuration - it works against default-reachable OAM authentication endpoints. The primary limiting factor is exposure scope: OAM is typically an internal or DMZ-fronted IAM component, so real-world reach depends on whether the OAM authentication endpoint is network-accessible to the attacker, and the fix is delivered only via the Oracle September 2026 CPU.

This is a genuinely high-priority vulnerability with strongly self-consistent signals. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, base 9.1) describes a remote, network-reachable (HTTP), low-complexity, unauthenticated flaw in the Authentication Engine of Oracle Access Manager - the exact component whose job is to enforce identity, so a CWE-287 authentication weakness here is maximally impactful. The vector and the free-text description agree: 'Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP' aligns cleanly with AC:L/PR:N/UI:N, and the C:H/I:H/A:N impact (full read plus create/delete/modify of all OAM-accessible data, no availability effect) matches the '9.1 Confidentiality and Integrity impacts' wording exactly. There is no signal conflict to flag. Missing signals: no EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' The absence of these does not lower the intrinsic risk - an unauthenticated auth-bypass in an SSO/IAM chokepoint is precisely the class Oracle patches in quarterly CPUs and that attackers reverse-engineer post-release. Treat as a real priority for any Oracle Access Manager deployment, not a high-CVSS-but-low-real-risk paper cut.

An unauthenticated attacker with only HTTP network reach to an Oracle Access Manager endpoint sends a crafted request that abuses a flaw in the Authentication Engine to bypass authentication, gaining unauthorized read and write access to all OAM-accessible data (effectively impersonating or acquiring privileged access across everything OAM protects). Because OAM is the SSO gatekeeper, this can cascade into access to every downstream application it fronts. No public exploit code was identified at the time of analysis, but the low attack complexity and unauthenticated vector make weaponization straightforward once details circulate.