The vulnerability, identified in the Authentication Engine of Oracle Access Manager, allows an attacker with network connectivity to authenticate without credentials over HTTP, leading to full compromise of the service. Successful exploitation grants control over the Access Manager and can propagate to other connected components due to a scope change. The impact includes loss of confidentiality, integrity, and availability, with a CVSS 3.1 base score of 10.0.

Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 are affected. These releases are part of Oracle Fusion Middleware, commonly deployed in enterprise environments.

The EPSS score of less than 1% indicates a low likelihood of exploitation, but the severe impact and lack of user interaction make it a critical threat. Attackers can exploit the weakness via standard HTTP traffic without authentication; the vulnerability is not listed in the CISA KEV catalog. Mitigation must come from applying vendor patches or limiting network exposure.