CVE-2026-35314: Oracle Access Manager Authentication Bypass (CVSS 7.3)

Technical summary

CVE-2026-35314 is an improper access control vulnerability (CWE-284) in the Oracle Access Manager Web Server Plugin component. The flaw permits unauthenticated network-based attackers to execute HTTP requests that result in unauthorized data manipulation and disclosure. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) reflects the network-adjacent attack surface, low complexity, absence of privilege or interaction requirements, and cumulative impact on confidentiality, integrity, and availability. The vulnerability does not trigger CVSS scope expansion, meaning impacts are contained to the affected resource itself.

Business impact

Compromise of Oracle Access Manager instances threatens the integrity of identity and access governance infrastructure. Attackers can read sensitive authentication data, policy configurations, and user information; modify access controls and user records; and degrade availability of authentication services. Organizations relying on Oracle Access Manager for workforce or external user authentication face elevated risk of lateral movement, privilege escalation, and identity spoofing. The lack of authentication requirements means the attack surface is not limited to trusted administrators or known users.

Affected systems

Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 are confirmed affected. The vulnerability resides in the Web Server Plugin component, which means organizations deploying Oracle Access Manager with HTTP-accessible web server integrations are at risk. Verify your version against Oracle's official release documentation. Earlier and later versions should be cross-referenced against vendor advisories to determine exposure status.

Exploitability

This vulnerability scores at the top of the exploitability spectrum: network-reachable, no authentication required, no user interaction needed, and technically simple to trigger. No CVSS compensation factors (e.g., attack complexity, privilege requirements) are present. Public disclosure and active scanning are likely, making weaponization probability high. However, the vulnerability has not been added to CISA's Known Exploited Vulnerabilities catalog as of the current advisory date, so widespread active exploitation in the wild has not been formally documented at publication time.

Remediation

Apply security patches from Oracle as soon as they become available. Oracle typically releases patches during its Critical Patch Update (CPU) cycle. Until patches are available, implement network segmentation to restrict HTTP access to Oracle Access Manager instances to authorized hosts only. Disable or restrict the Web Server Plugin if it is not essential to operations. Monitor for suspicious authentication bypass attempts and unusual data access patterns.

Patch guidance

Consult Oracle's official security advisory and CPU announcements for specific patch versions addressing CVE-2026-35314. Patches will be release-specific; verify that the patch version supports your currently deployed Oracle Access Manager release (12.2.1.4.0 or 14.1.2.1.0) before deployment. Apply patches in a controlled manner, starting with non-production environments. Oracle Access Manager patches typically require application server restart; coordinate deployment with your change management process to minimize authentication service interruption.

Detection guidance

Monitor web server and application logs for unauthenticated HTTP requests targeting Oracle Access Manager endpoints, particularly those that result in unexpected data access or modification. Look for requests lacking valid session tokens or authentication headers. Network intrusion detection systems should be tuned to flag anomalous access patterns to the Web Server Plugin component. Query user access logs for data read, update, or delete operations originating from unauthenticated or unexpected sources. Consider deploying compensating controls such as Web Application Firewalls (WAF) configured with rules to enforce authentication requirements.

Why prioritize this

This vulnerability merits immediate prioritization due to the combination of high CVSS score (7.3), complete absence of authentication barriers, network accessibility, and direct impact on identity infrastructure. Compromise of Oracle Access Manager weakens the security posture of dependent applications and services. Although not yet on CISA's KEV list, the ease of exploitation and high business impact make it a target for opportunistic and sophisticated attackers alike. Organizations running affected versions should treat this as critical.

Risk score, explained

The CVSS 3.1 score of 7.3 (HIGH severity) reflects the vulnerability's network attack vector, low complexity, lack of privilege or user interaction requirements, and impacts spanning confidentiality, integrity, and availability. While scope is not expanded (contained to the affected component), the convergence of unrestricted network access, unauthenticated exploitation, and multi-faceted impact (read, write, delete, denial of service) justifies the high rating. The score does not penalize for lack of active exploitation, so actual risk may escalate rapidly once exploitation tools are available.

Frequently asked questions