CVE-2026-35314: Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Web Server Plugin)

Synopsis

This is a multi-impact vulnerability in the Web Server Plugin component of Oracle Access Manager (versions 12.2.1.4.0 and 14.1.2.1.0), part of Oracle Fusion Middleware. An unauthenticated attacker with HTTP network access can reach the affected component directly, with no prior login or user interaction required. Successful exploitation allows the attacker to read a subset of accessible data, write or delete some data, and partially disrupt service availability. HarborGuard is tracking the advisory for patch availability, as no fix version has been published yet.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Oracle Access Manager Web Server Plugin over HTTP from the network; no prior foothold on the host is needed.

• AuthenticationNot required

  No credentials or session token are required; the vulnerable endpoint accepts unauthenticated requests.

• Victim interactionNot required

  The attack is fully server-side and requires no action from any user or administrator.

• Attack complexityDetail

  Exploit conditions are low-complexity and reliable, with no race conditions or special environmental factors needed.

Blast Radius

• Reads a subset of data accessible to Oracle Access Manager, which may include identity attributes, session metadata, or policy data.
• Writes, inserts, or deletes some Oracle Access Manager accessible data, enabling tampering with identity records or access policies.
• Causes a partial denial of service against the Oracle Access Manager service, degrading authentication and authorization decisions for downstream applications.
• Because Oracle Access Manager acts as an identity gateway, any combination of the above impacts can affect the applications and users that rely on it for authentication.