A flaw in the Authentication Engine component of Oracle Access Manager lets an attacker who is not authenticated access the system from any network location over HTTP. The vulnerability is classified as a severe authentication bypass, allowing unauthorized users to view or manipulate all data the Access Manager is configured to protect. The vulnerability carries a CVSS v3.1 base score of 7.5, indicating a high confidentiality impact and the potential to compromise critical information.

Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 are affected, as listed in the advisory. These releases are part of Oracle Fusion Middleware and are used to control authentication across multiple Web applications.

The CVSS score of 7.5 places the flaw in the high severity range. The EPSS score of < 1% indicates a very low but nonzero probability of exploitation. Attackers only require network access to the HTTP interface of the Access Manager – no prior authentication or special credentials are needed. The vulnerability can be triggered by sending a crafted HTTP request to the component’s entry point, after which the attacker gains access to all resources available through the Access Manager. Given the lack of mitigations in current versions, exploitation is considered easily exploitable.