CVE-2026-35261: Oracle Access Manager Authentication Bypass (CVSS 6.5)

Technical summary

CVE-2026-35261 is an authentication engine vulnerability in Oracle Access Manager (Oracle Fusion Middleware) stemming from improper authentication controls (CWE-287). The vulnerability permits unauthenticated HTTP-based exploitation due to low attack complexity and no privilege requirements. The CVSS 3.1 score of 6.5 reflects combined confidentiality and integrity impacts: attackers can read a subset of accessible data and perform unauthorized create, update, and delete operations. The attack surface is the HTTP interface with no access vector restrictions, meaning any network-accessible instance is at risk.

Business impact

Access Manager is a critical identity and access control component in Oracle Fusion Middleware environments. Compromise enables attackers to manipulate user data, authentication records, and system configurations without detection or authorization. This can lead to privilege escalation, lateral movement within enterprise systems, compliance violations (especially in regulated industries), and reputational damage. Organizations relying on Access Manager for application and API authentication face direct threats to confidential data integrity and availability of downstream services.

Affected systems

Affected versions are Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 within Oracle Fusion Middleware. Any deployment of these versions accessible via HTTP (including internal networks, DMZs, or cloud instances) is vulnerable. Organizations should audit their Access Manager inventory and network exposure immediately. Later or earlier versions may also be affected; consult Oracle's security advisory for a complete supported versions list.

Exploitability

This vulnerability is highly exploitable. It requires only network access to the HTTP interface, no authentication, no user interaction, and minimal attack complexity. The barrier to exploitation is low—a basic HTTP client and knowledge of the endpoint are sufficient. Given the ease of exploitation and the critical nature of Access Manager in authentication workflows, this should be treated as an active threat with high likelihood of exploitation attempts once public details emerge.

Remediation

Apply security patches from Oracle as documented in their official advisory. Verify patch version numbers against the vendor's guidance. If patching is delayed, implement network-level mitigations: restrict HTTP access to Access Manager to trusted hosts and networks only, deploy Web Application Firewalls (WAF) to monitor for suspicious authentication requests, and enable detailed logging and alerting on authentication failures and data modification attempts. Conduct post-remediation testing to confirm the vulnerability is eliminated.

Patch guidance

Consult Oracle's security advisory for CVE-2026-35261 to identify patched versions for each affected release line. Test patches in a non-production environment before production deployment. Prioritize patching for instances accessible from external networks or untrusted networks. Document patch application and maintain version records for compliance. Oracle typically releases patches through their Critical Patch Update (CPU) cycle; verify timing and compatibility with your environment's maintenance windows.

Detection guidance

Monitor for unusual HTTP requests to Access Manager endpoints lacking proper authentication headers or tokens. Alert on repeated failed authentication attempts or authentication bypass patterns. Log and analyze any successful requests that bypass expected authentication controls. Search historical logs for evidence of unauthorized data modification or deletion associated with unauthenticated sessions. Network-based detection: identify HTTP traffic to Access Manager ports from unexpected sources. Endpoint Detection and Response (EDR) tools should flag processes making unauthorized database queries through Access Manager.

Why prioritize this

Despite a CVSS score of 6.5 (Medium), this vulnerability warrants high priority because: (1) it impacts a foundational identity and access control component, (2) exploitation requires no authentication or complexity, (3) it enables both data theft and manipulation, and (4) Access Manager is often a trust boundary in enterprise architectures. A single successful compromise can cascade to compromise of downstream applications and data. Organizations should treat this as a priority patch regardless of CVSS rating.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects a network-accessible vulnerability with no authentication or user interaction barriers (base factors: AV:N, AC:L, PR:N, UI:N). The score is constrained to Medium due to scope:unchanged and no availability impact. However, the practical risk is elevated because the vulnerability affects a critical security control (authentication engine), enabling both confidentiality and integrity breaches. Risk assessment should account for network exposure and the sensitivity of data protected by Access Manager, not CVSS score alone.

Frequently asked questions