The vulnerability resides in the Authentication Engine component of Oracle Access Manager, allowing an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data, effectively granting an attacker full access to all data exposed through Oracle Access Manager. The weakness is rated at a CVSS 3.1 base score of 10.0, reflecting severe confidentiality and integrity impacts.

The affected products are Oracle Access Manager version 12.2.1.4.0 and 14.1.2.1.0, as listed in the Oracle Security Alert for CPU Oct 2026. These versions remain supported but lack the necessary fixes until the advisory’s patches are applied.

The CVSS score of 10.0 indicates a critical risk, and with an EPSS score of less than 1% (0.00439), the probability of exploitation remains low. The vulnerability has not been reported in the CISA KEV catalog. The attack vector is through unauthenticated HTTP requests, meaning that any host with network connectivity to the Oracle Access Manager service could potentially exploit the flaw. The scope change noted in the description suggests that compromising Oracle Access Manager could also impact other linked components within Oracle Fusion Middleware.