Oracle Access Manager: Unauthenticated data access in Authentication Engine
Summary
Oracle Access Manager, part of Oracle Fusion Middleware, contains a critical flaw in its Authentication Engine component (CVE-2026-87337, CVSS 10.0, CWE-200). An unauthenticated attacker with network access via HTTP can read, change or delete data that Access Manager can access, and the impact may extend to other applications behind it (scope change). Access Manager fronts single sign-on, so a successful attack can affect the applications it protects.
Affected
- Oracle Access Manager 12.2.1.4.0
- Oracle Access Manager 14.1.2.1.0
Fixed in
- Apply the patches from Oracle's October 2026 Critical Patch Update (CPU).
- Specific patch numbers and fixed build versions: Unknown. Check the Oracle advisory for the patch set for each release line.
Workaround
- Unknown. No vendor workaround was found in the sources, and the Oracle advisory could not be reviewed.
- Interim measure: restrict which networks can reach Access Manager HTTP endpoints (allowlist or VPN) until patching is complete.
Exploitation
- No public proof of concept found.
- No confirmed in-the-wild exploitation found. Oracle's risk matrices do not mark it as exploited.
- CISA SSVC: exploitation none, automatable no, technical impact total.
Our recommendation
- If Access Manager 12.2.1.4.0 or 14.1.2.1.0 is reachable over HTTP from the internet, treat this as urgent.
- Apply the October 2026 CPU patches as soon as possible; otherwise follow the normal patch cycle.
- Until patched, restrict network access to Access Manager endpoints.
- Review logs for unusual requests to Access Manager and check exposure of the SSO applications it protects.
- Note: the attack vector and availability impact differ between sources; verify against the Oracle advisory.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Oracle Critical Patch Update October 2026 www.oracle.com
- NVD mirror: CVE-2026-87337 vulners.com
- Tenable plugin 369015 www.tenable.com
- Fortra analysis of the October 2026 CPU www.fortra.com
- Waratek: October 2026 CPU waratek.com
- NHS England Digital cyber alert CC-4876 digital.nhs.uk
- eSecurityPlanet: October 2026 CPU www.esecurityplanet.com
- Breach-signal: October 2026 CPU breach-signal.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:08.
Original description (NVD)
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Access Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.