Oracle Access Manager
Monthly
Unauthorized data access in Oracle Access Manager (Fusion Middleware, Authentication Engine) 12.2.1.4.0 and 14.1.2.1.0 allows a remote, unauthenticated attacker to compromise confidentiality over HTTP, with a scope change that can significantly impact other Oracle products relying on it for single sign-on. Tagged as an Authentication Bypass, the flaw carries a CVSS 3.1 score of 8.6 and is addressed in the Oracle Critical Patch Update of July 2026. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Oracle Access Manager (Oracle Fusion Middleware, Authentication Engine) versions 12.2.1.4.0 and 14.1.2.1.0 allows a remote, unauthenticated attacker to read and modify all data accessible to the product via crafted HTTP requests. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact, the flaw was disclosed by Oracle in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis, and the low attack complexity plus no-privilege/no-interaction requirements make it a top-priority patch for any Oracle IAM deployment.
Full takeover of Oracle Access Manager (Authentication Engine component) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.1.0 is possible for a low-privileged attacker positioned on the same physical/adjacent network segment as the host running OAM. Per the CVSS vector (AV:A/AC:L/PR:L), exploitation is low-complexity and requires only some level of existing authenticated access plus adjacent network reachability, yielding complete confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis; addressed in Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle Access Manager 14.1.2.1.0 (Oracle Fusion Middleware) is possible through its Authentication Engine, allowing a low-privileged attacker with HTTP network access to take over the identity and access management platform. Oracle rates this CVSS 3.1 8.8 with high impact to confidentiality, integrity, and availability, and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote unauthenticated compromise of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 is possible via the Web Server Plugin component over HTTP, allowing attackers to alter or read subsets of OAM data and trigger partial denial of service. The flaw carries a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N) and is rated easily exploitable by Oracle. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.
Privilege escalation and takeover of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged remote attacker to fully compromise the identity broker via the Authentication Engine component, with a CVSS 9.9 score reflecting a scope-changing impact on downstream protected applications. No public exploit identified at time of analysis, but Oracle's June 2026 Critical Patch Update flags it as easily exploitable over HTTP, making it a high-priority patch for any environment using OAM for SSO/federation.
Unauthorized read and write access to Oracle Access Manager data is achievable by unauthenticated remote attackers through a network-accessible HTTP attack against the Authentication Engine component, affecting versions 12.2.1.4.0 and 14.1.2.1.0. The vulnerability carries a scope change, meaning successful exploitation can impact products beyond Oracle Access Manager itself - consistent with an authentication-layer flaw such as open redirect or reflected cross-site scripting that can compromise dependent applications sharing the SSO context. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog.
Remote exploitation of Oracle Access Manager's Authentication Engine allows unauthenticated network attackers - contingent on user interaction - to achieve limited confidentiality and integrity compromise, with scope change propagating impact to additional Fusion Middleware products. Versions 12.2.1.4.0 and 14.1.2.1.0 are confirmed affected per Oracle's June 2026 Critical Patch Update. The scope change (S:C) is particularly notable because OAM functions as an SSO gateway, meaning even limited manipulation during authentication flows can cascade to downstream applications sharing that identity fabric. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Unauthenticated network exploitation of Oracle Access Manager's Authentication Engine enables partial data read and modification without credentials. Affected deployments running versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Access Manager within Oracle Fusion Middleware are exposed via HTTP on the network, with no user interaction required. The vendor-tagged classification of 'Authentication Bypass' in a component explicitly responsible for authentication processing makes this particularly sensitive given OAM's role as a centralized enterprise SSO and policy enforcement gateway; no public exploit or CISA KEV listing is confirmed at time of analysis.
Unauthorized data access in Oracle Access Manager (Fusion Middleware, Authentication Engine) 12.2.1.4.0 and 14.1.2.1.0 allows a remote, unauthenticated attacker to compromise confidentiality over HTTP, with a scope change that can significantly impact other Oracle products relying on it for single sign-on. Tagged as an Authentication Bypass, the flaw carries a CVSS 3.1 score of 8.6 and is addressed in the Oracle Critical Patch Update of July 2026. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Authentication bypass in Oracle Access Manager (Oracle Fusion Middleware, Authentication Engine) versions 12.2.1.4.0 and 14.1.2.1.0 allows a remote, unauthenticated attacker to read and modify all data accessible to the product via crafted HTTP requests. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact, the flaw was disclosed by Oracle in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis, and the low attack complexity plus no-privilege/no-interaction requirements make it a top-priority patch for any Oracle IAM deployment.
Full takeover of Oracle Access Manager (Authentication Engine component) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.1.0 is possible for a low-privileged attacker positioned on the same physical/adjacent network segment as the host running OAM. Per the CVSS vector (AV:A/AC:L/PR:L), exploitation is low-complexity and requires only some level of existing authenticated access plus adjacent network reachability, yielding complete confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis; addressed in Oracle's July 2026 Critical Patch Update.
Full compromise of Oracle Access Manager 14.1.2.1.0 (Oracle Fusion Middleware) is possible through its Authentication Engine, allowing a low-privileged attacker with HTTP network access to take over the identity and access management platform. Oracle rates this CVSS 3.1 8.8 with high impact to confidentiality, integrity, and availability, and describes it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Remote unauthenticated compromise of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 is possible via the Web Server Plugin component over HTTP, allowing attackers to alter or read subsets of OAM data and trigger partial denial of service. The flaw carries a CVSS 3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N) and is rated easily exploitable by Oracle. No public exploit identified at time of analysis, and the CVE is not currently listed in CISA KEV.
Privilege escalation and takeover of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged remote attacker to fully compromise the identity broker via the Authentication Engine component, with a CVSS 9.9 score reflecting a scope-changing impact on downstream protected applications. No public exploit identified at time of analysis, but Oracle's June 2026 Critical Patch Update flags it as easily exploitable over HTTP, making it a high-priority patch for any environment using OAM for SSO/federation.
Unauthorized read and write access to Oracle Access Manager data is achievable by unauthenticated remote attackers through a network-accessible HTTP attack against the Authentication Engine component, affecting versions 12.2.1.4.0 and 14.1.2.1.0. The vulnerability carries a scope change, meaning successful exploitation can impact products beyond Oracle Access Manager itself - consistent with an authentication-layer flaw such as open redirect or reflected cross-site scripting that can compromise dependent applications sharing the SSO context. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog.
Remote exploitation of Oracle Access Manager's Authentication Engine allows unauthenticated network attackers - contingent on user interaction - to achieve limited confidentiality and integrity compromise, with scope change propagating impact to additional Fusion Middleware products. Versions 12.2.1.4.0 and 14.1.2.1.0 are confirmed affected per Oracle's June 2026 Critical Patch Update. The scope change (S:C) is particularly notable because OAM functions as an SSO gateway, meaning even limited manipulation during authentication flows can cascade to downstream applications sharing that identity fabric. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Unauthenticated network exploitation of Oracle Access Manager's Authentication Engine enables partial data read and modification without credentials. Affected deployments running versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Access Manager within Oracle Fusion Middleware are exposed via HTTP on the network, with no user interaction required. The vendor-tagged classification of 'Authentication Bypass' in a component explicitly responsible for authentication processing makes this particularly sensitive given OAM's role as a centralized enterprise SSO and policy enforcement gateway; no public exploit or CISA KEV listing is confirmed at time of analysis.