CVE-2026-83001

A critical (CVSS 9.1) vulnerability exists in the Authentication Engine component of Oracle Access Manager (OAM), part of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.1.0. It is easily exploitable over the network via HTTP, but requires a highly privileged (already authenticated, admin-level) account, meaning it is a post-authentication takeover vector rather than an anonymous attack. Successful exploitation lets the attacker fully compromise Oracle Access Manager — with complete impact on confidentiality, integrity, and availability — and because the scope changes, downstream products and services that rely on OAM for single sign-on and authentication can also be significantly impacted. Any organization running the two affected OAM versions as its federated identity/SSO layer is exposed, particularly if administrative OAM endpoints are reachable over the network. There is no known public proof-of-concept and no evidence of in-the-wild exploitation at this time.

What to do: Apply the Oracle Critical Patch Update covering CVE-2026-83001 to OAM 12.2.1.4.0 and 14.1.2.1.0 as the top priority, since OAM is a tier-0 identity asset even for a privileged-only flaw. Restrict network access to the OAM administration console and administrative APIs (allow-list admin networks, enforce MFA for privileged accounts) to shrink the pool of would-be attackers. Review OAM and web server logs for anomalous activity by high-privileged accounts and verify that SSO-protected downstream applications have not been tampered with.