A high-severity vulnerability in the Oracle Access Manager Authentication Engine allows low-privileged attackers to compromise the entire system through scope escalation.

This vulnerability affects the Authentication Engine and allows an attacker with low-level privileges to perform an unauthorized system takeover via HTTP, impacting the security of the broader environment due to scope change.

The CVSS score of 9.9 underscores the extreme risk posed by this vulnerability. By exploiting the authentication engine, an attacker with minimal access can escalate their privileges to take control of the entire Access Manager instance. This represents a catastrophic failure of identity and access management, potentially exposing all downstream applications and services protected by the Oracle platform.

Immediate Action: Apply the July 2026 Oracle Critical Patch Update to all instances of Oracle Access Manager immediately.

Proactive Monitoring: Monitor authentication logs for suspicious activity or anomalous behavior from low-privileged user accounts, and review server logs for signs of privilege escalation attempts.

Compensating Controls: Reduce the attack surface by limiting the number of users with low-level access to the management interfaces until the patches are applied.

Public Exploit Available: No confirmed public exploit available.

This vulnerability represents a significant threat to internal security and identity integrity. It is essential to treat this as a high-priority remediation task and deploy the available vendor patches across all affected environments as quickly as possible.