The flaw resides in the Authentication Engine component of Oracle Access Manager, allowing an unauthenticated attacker who can reach the service over HTTP to create, delete, or modify access permissions and to read critical data. These actions directly compromise confidentiality and integrity, enabling the attacker to alter or erase protected information and to gain unauthorized access to all data managed by the system. Based on the description, it is inferred that the vulnerability results from a lack of authentication or authorization enforcement.

Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 are affected. These versions are part of Oracle Fusion Middleware. Compromise of Access Manager may also expose other components that rely on the same authentication infrastructure.

The CVSS 3.1 base score of 8.7 signals a high‑severity vulnerability. The EPSS score is less than 1%, indicating a very low probability of exploitation. The vulnerability can be triggered remotely over HTTP, meaning an attacker with network or Internet access to the exposed service could exploit it. The scope change flag indicates that a successful exploit may impact additional products within the environment.