Description

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authorization Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Access Manager. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-18T21:18:13.177Z",
  "pubdate": "2026-08-18T21:18:13.177Z",
  "executiveSummary": "A vulnerability exists within the Authorization Engine component of Oracle Access Manager, specifically affecting versions 12.2.1.4.0 and 14.1.2.1.0 within Oracle Fusion Middleware. This flaw allows a remote, authenticated attacker with low privileges and network access via TCP to compromise the targeted system's availability.\nSuccessful exploitation of this vulnerability results in an unauthorized partial denial of service condition against Oracle Access Manager, degrading service performance or disrupting specific authorization processing workflows. The vulnerability presents an inherent risk to operational continuity by exhausting system resources or triggering application faults within the authorization pipeline.\nThe attack vector is network-based, requiring low network privileges but no user interaction, making it accessible to authenticated internal users or compromised accounts. The CVSS 3.1 base score is 4.3, with impacts exclusively isolated to the availability metric, while confidentiality and integrity remain unaffected.",
  "technicalDetails": "The vulnerability resides in the Authorization Engine component of Oracle Access Manager, which handles evaluation of access policies and user permissions during runtime operations across Oracle Fusion Middleware deployments. Affected versions include 12.2.1.4.0 and 14.1.2.1.0.\nThe root cause stems from improper handling of specific crafted input payloads or resource management deficiencies within the authorization evaluation routines exposed over TCP network services. When an attacker submits maliciously constructed requests to the vulnerable component, the application encounters an exception, enters an infinite loop, or disproportionately consumes memory and CPU resources.\nExploitation requires the attacker to possess low privileges within the application environment and network connectivity via TCP to the Oracle Access Manager listener ports. The attack flow begins with the authenticated low-privileged user establishing a network session and transmitting a specially crafted request designed to trigger the flaw in the Authorization Engine.\nUpon receipt, the vulnerable component attempts to process the malformed data structure within the authorization logic. Due to inadequate input validation or improper exception handling, the processing routine fails catastrophically or enters an unresponsive state, resulting in a partial denial of service.\nThe payload behavior is focused strictly on resource exhaustion or service disruption rather than remote code execution, privilege escalation, or unauthorized data exfiltration. Consequently, post-exploitation impact is limited to the degradation or localized failure of authorization services, affecting authentication and access control enforcement for dependent applications."
}