A vulnerability in the Authentication Engine component of Oracle Access Manager allows an unauthenticated attacker with network access via SAML to compromise the application. The flaw permits bypassing authentication controls, leading to full takeover of the Access Manager instance and unrestricted access to its configuration and user data. The impact includes loss of confidentiality, integrity, and availability for systems dependent on the compromised Access Manager.

Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.0.0, part of the Oracle Fusion Middleware suite, host the Authentication Engine that processes SAML assertions. Systems running these versions without the latest vendor patch are at risk.

The CVSS base score of 8.1 indicates high severity with full confidentiality, integrity, and availability impact. The attack vector is network based, accessed through SAML endpoints, and requires no user interaction, though a high attack complexity is noted. The EPSS score is below 1%, suggesting low current exploitation likelihood, but the vulnerability is not listed in CISA's KEV catalog, so there is no evidence of widespread exploitation yet. Nevertheless, the vulnerability can allow remote compromise of the Access Manager, making timely patching critical.