A flaw in the Authentication Engine of Oracle Access Manager allows an unauthenticated attacker with network access over HTTP to bypass authentication controls, granting unauthorized read, write, or delete operations on data the service exposes. The attacker can also trigger a partial denial of service, compromising system availability. The underlying weakness is an authentication bypass, representing an improper authentication and access control flaw covering confidentiality, integrity, and availability.

Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.0.0 are affected, as noted in the Oracle CPU Oct 2026 advisory. These releases bundle the vulnerability in the Authentication Engine component of Oracle Fusion Middleware.

With a CVSS base score of 8.6, the vulnerability is considered high severity. No EPSS data is available, and it is not listed in the CISA KEV catalog. The attack vector is remote, unauthenticated over HTTP, requiring only network reachability to the HTTP endpoint. Given the full access to critical data, potential data tampering, and partial denial of service, the risk to unpatched systems is substantial.