Oracle Access Manager: Improper authentication in Authentication Engine
Summary
Oracle Access Manager, part of Oracle Fusion Middleware, contains an improper authentication flaw in its Authentication Engine that is reachable via SAML. An unauthenticated attacker with network access can exploit it under high attack complexity and take over Oracle Access Manager, with high impact on confidentiality, integrity and availability. Access Manager acts as single sign-on front end, so a compromise can extend to the applications it protects. Oracle addresses the issue in its October 2026 Critical Patch Update.
Affected
- Oracle Access Manager 12.2.1.4.0 - Oracle Access Manager 14.1.2.0.0 (per CVE record; sibling CVEs in the same CPU list 14.1.2.1.0, so verify the exact builds against the Oracle advisory)
Fixed in
Unknown. Apply the patch from the October 2026 Oracle Critical Patch Update (see Oracle advisory for build numbers).
Workaround
- No Oracle-specific workaround known. - Interim measure from a third-party write-up on CVE-2026-70905, not from Oracle: restrict access to OAM Agent and SAML endpoints to trusted networks and identity provider IP ranges, and disable unused SAML federation partners.
Exploitation
- No evidence of exploitation of CVE-2026-83409 found. - No public proof of concept known. - CISA SSVC: Exploitation none, Automatable no, Technical Impact total. - EPSS score 0.00377.
Our recommendation
- Confirm whether any client runs Oracle Access Manager 12.2.1.4.x or 14.1.2.x. - Check the exact build against the Oracle advisory. - Apply the October 2026 CPU patch, prioritising internet-facing instances. - Until patched, restrict SAML endpoint access to known identity providers. - Note that the CVSS score is 8.1 per the CNA record, while Vulmon lists 9.8.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Security Alert October 2026 CPU www.oracle.com
- NVD record via Vulners CVE-2026-83409 vulners.com
- Strix CVE-2026-83409 www.strix.ai
- Tenable Nessus plugin 369015 www.tenable.com
- eSecurity Planet: Oracle October 2026 CPU www.esecurityplanet.com
- Waratek: Oracle October 2026 CPU waratek.com
- Brandefense: Oracle October 2026 CPU brandefense.io
- Vulmon priority CVEs vulmon.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:20.
Original description (NVD)
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SAML to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.