The vulnerability is a CWE-287 authentication bypass weakness. It enables an unauthenticated attacker who can reach the system over HTTP to compromise the Oracle Access Manager Authentication Engine, leading to full takeover. The impact includes loss of confidentiality, integrity, and availability, as indicated by the CVSS score of 9.8.

Oracle Access Manager, versions 12.2.1.4.0 and 14.1.2.1.0 are affected.

The likely attack vector is an unauthenticated HTTP session, as inferred from the description. 9.8 demonstrates a high severity, and the EPSS score of less than 1% indicates low current exploitation probability but does not negate the risk. The vulnerability can be exploited by any networked attacker without authentication, and it is listed as not yet in the CISA KEV catalog. The attack path is straightforward: an unauthenticated HTTP session initiates a request that bypasses required authentication and grants control over the Access Manager.