The vulnerability in Oracle Access Manager permits an attacker who can reach the system over HTTP to compromise authentication mechanisms without needing to be authenticated initially. The flaw allows the attacker, with the cooperation of a third‑party user, to perform unauthorized update, insert or delete operations on data that the Access Manager exposes. The same flaw also enables unauthorized reading of a subset of the data guarded by the Access Manager. The impact is limited to confidentiality and integrity of that data set, as availability is not affected.

Products affected are Oracle Access Manager version 12.2.1.4.0 and version 14.1.2.1.0, which are part of Oracle Fusion Middleware. No other vendor products are listed, but successful exploitation could influence additional systems that rely on Oracle Access Manager for authentication services.

The recorded CVSS 3.1 score of 6.1 indicates a moderate severity, with a small impact on confidentiality and integrity. The EPSS score of less than 1% signifies a low probability of current exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the likely attack vector is network communication over HTTP; the attacker must have network access to the Oracle Access Manager instance and, importantly, human interaction from a user other than themselves to trigger the malicious activity. The requirement for non‑attacker involvement reduces the overall risk, but the potential to alter or view protected data remains significant.