Oracle Access Manager SAML Flaw Lets Attackers Seize Control

An attacker can completely take over an Oracle Access Manager server by exploiting a flaw in its SAML handling. The vulnerability requires no credentials from the attacker, who only needs network access to the system. This means anyone on the internet who can reach the server can potentially compromise it. The National Vulnerability Database lists this issue as CVE-2026-87251. The flaw resides in the Authentication Engine component of Oracle Fusion Middleware. It affects two specific versions of the software: 12.2.1.4.0 and 14.1.2.1.0. Security teams must assess if these versions are deployed in their environments.

In plain English

This vulnerability allows a remote attacker to bypass normal security checks. The attacker does not need a username or password to start the attack. They simply send a specially crafted request to the server using the SAML protocol. SAML is commonly used for single sign-on, allowing users to log in once and access multiple apps. The flaw in how Oracle Access Manager processes these requests lets the attacker gain full control. This is not a minor issue; it results in a complete takeover of the affected system. The attacker can then read, change, or delete data stored on the server.

The background

The National Vulnerability Database rates this flaw with a CVSS 3.1 Base Score of 9.8. This score is considered critical, the highest possible severity level. The vector string indicates that the attack is network-based and has low complexity. It requires no privileges and no user interaction. The impact covers confidentiality, integrity, and availability, all rated as high. This means the attacker can steal data, alter system functions, and disrupt services. Oracle Access Manager is part of Oracle Fusion Middleware. It manages user access to enterprise applications.

What changes now

Organizations using Oracle Access Manager must check their current versions immediately. If they are running version 12.2.1.4.0 or 14.1.2.1.0, they are vulnerable. There is no mention of a patch or fix in the source material. Therefore, no official remediation steps are confirmed yet. Security teams should monitor for updates from Oracle. In the meantime, they may consider restricting network access to the Authentication Engine. This reduces the attack surface while waiting for a vendor solution.

What made it possible

This incident illustrates the risk of trusting external identity assertions without rigorous validation. Attackers often exploit flaws in how systems process authentication tokens like SAML. When an application fails to verify the origin or integrity of these tokens, it can be tricked into granting unauthorized access. This technique serves the initial access stage of an intrusion. Teams usually review how their systems handle incoming identity requests. Check whether your environment validates all SAML assertions against trusted sources. Ensure that any unexpected or malformed tokens are rejected immediately.

Background: Single sign-on

Single sign-on uses a central identity provider to authenticate users once. The provider issues a signed token to applications, which verify the signature without contacting the provider again. This reduces password fatigue but concentrates risk in the identity layer.

Read the full guide: How Single Sign-On Works: The Protocol Mechanics Behind Auth

What to do and how to stay safe: Oracle Access Manager

• Verify if your organization uses Oracle Access Manager versions 12.2.1.4.0 or 14.1.2.1.0.
• Restrict network access to the Authentication Engine to trusted IP addresses only.
• Monitor logs for unusual SAML traffic or unexpected authentication attempts.
• Wait for an official update from Oracle before applying any unverified fixes.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVE ID for this Oracle Access Manager flaw?

The CVE ID is CVE-2026-87251.

Which versions of Oracle Access Manager are affected?

Versions 12.2.1.4.0 and 14.1.2.1.0 are affected.

Does this vulnerability require authentication to exploit?

No, it allows unauthenticated attackers to exploit the flaw.