{"id":"CVE-2026-83409","kind":"vulnerability","aliases":["CVE-2026-83409"],"related":[],"title":"Oracle Access Manager: SAML authentication flaw lets unauthenticated attackers take over","description":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SAML to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Access Manager's Authentication Engine, in supported versions 12.2.1.4.0 and 14.1.2.0.0, has a flaw reachable over the network through SAML. An unauthenticated attacker who can exploit it can take over the Access Manager server.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["identity","oracle-access-manager","oracle-fusion-middleware","saml","self-hosted","vendor"],"not_affected_if":["no-saml-exposure","other-versions"],"how_to_check":"- Check the installed Oracle Access Manager version against `12.2.1.4.0` and `14.1.2.0.0`\n- Review whether SAML is enabled on the Access Manager deployment (unknown if the sources give a setting name)","fix":"- Apply the Oracle Critical Patch Update fix for Oracle Access Manager (unknown patch identifier in the sources)\n- Move to a patched release of Oracle Access Manager 12.2.1.4.x or 14.1.2.x (unknown exact version in the sources)","status":"open","published_at":"2026-10-20T22:19:57+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T03:06:14+00:00","updated_at":"2026-10-25T03:06:14+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-10-25T03:06:14Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle Access Manager (unknown patch identifier in the sources)\n- Move to a patched release of Oracle Access Manager 12.2.1.4.x or 14.1.2.x (unknown exact version in the sources)","reach":"internet","title":"Oracle Access Manager: SAML authentication flaw lets unauthenticated attackers take over","impact":"high","summary":"Oracle Access Manager's Authentication Engine, in supported versions 12.2.1.4.0 and 14.1.2.0.0, has a flaw reachable over the network through SAML. An unauthenticated attacker who can exploit it can take over the Access Manager server.","category":"vendor","nicknames":[],"who_cares":["oracle-access-manager","oracle-fusion-middleware","saml","identity","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker takes over the Oracle Access Manager server","analyst_note":"Check the Oracle Critical Patch Update advisory and the NVD entry for the patch identifier and whether SAML must be enabled for exposure.","how_to_check":"- Check the installed Oracle Access Manager version against `12.2.1.4.0` and `14.1.2.0.0`\n- Review whether SAML is enabled on the Access Manager deployment (unknown if the sources give a setting name)","needs_analyst":true,"not_affected_if":["other-versions","no-saml-exposure"],"who_is_affected":"Organizations running Oracle Access Manager 12.2.1.4.0 or 14.1.2.0.0 with SAML reachable from the network. Deployments without those versions, or without network-exposed SAML endpoints, are not affected by this entry. Exploitation is described as difficult, so attack complexity is high.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00068,"input_tokens":3466,"output_tokens":666,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-83409':13A,16A '/av':133C '12.2.1.4.0':40B,86C '14.1.2.0.0':42B,88C '3.1':120C,132C '8.1':123C 'access':2A,20B,32B,63B,70C,98C,104C,117C 'affect':84C 'allow':93C 'attack':9A,54B,95C,107C 'authent':5A,35B,78C 'avail':127C 'base':121C 'compon':77C 'compromis':102C 'confidenti':124C 'cve':11A,14A 'cvss':119C,129C,131C 'difficult':89C 'engin':36B,79C 'exploit':57B,91C 'flaw':6A,45B 'fusion':24B,75C 'h':141C 'h/a':140C 'h/i':139C 'h/pr':135C 'host':29B 'ident':17B 'impact':128C 'integr':125C 'let':7A 'manag':3A,21B,33B,64B,71C,105C,118C 'middlewar':25B,76C 'n/ac':134C 'n/s':137C 'n/ui':136C 'network':49B,97C 'oracl':1A,19B,23B,31B,69C,74C,103C,116C 'oracle-access-manag':18B 'oracle-fusion-middlewar':22B 'product':72C 'reachabl':46B 'result':112C 'saml':4A,26B,51B,100C 'score':122C 'self':28B 'self-host':27B 'server':65B 'success':106C 'support':38B,80C 'take':10A,60B 'takeov':114C 'u/c':138C 'unauthent':8A,53B,94C 'vector':130C 'vendor':30B 'version':39B,81C 'via':99C 'vulner':66C,92C,110C","nicknames":[],"mitigations":[],"who_affected":"Organizations running Oracle Access Manager 12.2.1.4.0 or 14.1.2.0.0 with SAML reachable from the network. Deployments without those versions, or without network-exposed SAML endpoints, are not affected by this entry. Exploitation is described as difficult, so attack complexity is high.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:57+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-83409","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83409","severity":null,"published_at":"2026-10-20T22:19:57+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}