Oracle Access Manager: Missing authentication in SAML authentication engine
Summary
Oracle Access Manager, an identity and single sign-on product in Oracle Fusion Middleware, contains a flaw in its Authentication Engine. The CNA rates it CVSS 9.8 (Critical): an unauthenticated attacker with network access can reach the SAML functionality and take over Access Manager, with full impact on confidentiality, integrity and availability. Because Access Manager sits in front of connected applications, a compromise may extend to those applications. Some sources report conflicting details, so the Oracle advisory is the reference.
Affected
- Oracle Access Manager 12.2.1.4.0
- Oracle Access Manager 14.1.2.1.0
Fixed in
Unknown. Check the Oracle Critical Patch Update Advisory for October 2026.
Workaround
- No vendor workaround found.
- Restrict network access to the Access Manager SAML endpoints until patched.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof-of-concept found.
Our recommendation
- Check whether Access Manager 12.2.1.4.0 or 14.1.2.1.0 is in use and whether its SAML endpoints are reachable from the internet.
- Restrict access to the SAML endpoints and review logs for unexpected SAML authentication activity until patched.
- Apply the patch from the October 2026 Oracle Critical Patch Update once the fixed version is confirmed in the Oracle advisory.
- Verify the severity and attack details against the Oracle advisory, as Vulmon lists 9.3 and Tenable describes HTTP access.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update Advisory, October 2026 www.oracle.com
- Strix: CVE-2026-87251 www.strix.ai
- Vulners NVD mirror: CVE-2026-87251 vulners.com
- Tenable plugin 369015 www.tenable.com
- Waratek: Oracle October 2026 CPU waratek.com
- SecurityOnline: Oracle October 2026 CPU securityonline.info
- Breach-Signal: Oracle October 2026 CPU breach-signal.com
- Vulmon priority CVEs vulmon.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:15.
Original description (NVD)
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SAML to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.