Description
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SAML to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Remote System Compromise
Action: Immediate Patch
AI Analysis

Impact

An authentication vulnerability in Oracle Access Manager’s Authentication Engine allows an unauthenticated attacker with network access via SAML to bypass authentication controls and fully compromise the Access Manager instance, jeopardizing confidentiality, integrity and availability of the system. The weakness is an improper authentication flaw.

Affected Systems

Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 are affected; these versions belong to Oracle Fusion Middleware. The vulnerability is confined to the Authentication Engine component.

Risk and Exploitability

The CVSS v3.1 base score of 9.8 indicates critical severity, with the attack vector being network-based and no need for user interaction. The EPSS score is below 1% and the vulnerability is not yet listed in CISA KEV, suggesting no widespread active exploitation has been recorded. Nonetheless, the high CVSS score and the ability to take full control of the Access Manager present a high‑risk threat that could be exploited by targeted attackers.

Generated by OpenCVE AI on October 22, 2026 at 08:17 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle Access Manager patch, including security updates for versions 12.2.1.4.0 and 14.1.2.1.0, as released in the Oracle CPU October 2026 advisory.
  • Restrict network access to the Access Manager SAML endpoints to trusted hosts or networks to reduce exposure.
  • Disable or remove any unused authentication providers or modules that process SAML assertions on the affected servers.
  • Monitor access logs for suspicious SAML authentication attempts and enforce strict auditing of login events.

Generated by OpenCVE AI on October 22, 2026 at 08:17 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 22 Oct 2026 08:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated SAML Exploit Enables Full Takeover of Oracle Access Manager

Wed, 21 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 07:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated SAML Exploit Enables Full Takeover of Oracle Access Manager
Weaknesses CWE-287

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SAML to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle access Manager
CPEs cpe:2.3:a:oracle:access_manager:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:access_manager:14.1.2.1.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle access Manager
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Access Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-21T10:55:18.624Z

Reserved: 2026-09-08T21:49:12.406Z

Link: CVE-2026-87251

cve-icon Vulnrichment

Updated: 2026-10-21T10:54:34.239Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:05.597

Modified: 2026-11-04T14:25:56.750

Link: CVE-2026-87251

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T21:00:08Z

Weaknesses
  • CWE-287

    Improper Authentication

  • CWE-306

    Missing Authentication for Critical Function