---
id: "CVE-2026-83409"
kind: "vulnerability"
aliases: ["CVE-2026-83409"]
title: "Oracle Access Manager: SAML authentication flaw lets unauthenticated attackers take over"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["identity", "oracle-access-manager", "oracle-fusion-middleware", "saml", "self-hosted", "vendor"]
not_affected_if: ["no-saml-exposure", "other-versions"]
published_at: "2026-10-20T22:19:57+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-25T03:06:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83409", "first_seen_at": "2026-10-23T21:57:25+00:00"}]
---

# Oracle Access Manager: SAML authentication flaw lets unauthenticated attackers take over

Oracle Access Manager's Authentication Engine, in supported versions 12.2.1.4.0 and 14.1.2.0.0, has a flaw reachable over the network through SAML. An unauthenticated attacker who can exploit it can take over the Access Manager server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Oracle Access Manager version against `12.2.1.4.0` and `14.1.2.0.0`
- Review whether SAML is enabled on the Access Manager deployment (unknown if the sources give a setting name)

## Fix

- Apply the Oracle Critical Patch Update fix for Oracle Access Manager (unknown patch identifier in the sources)
- Move to a patched release of Oracle Access Manager 12.2.1.4.x or 14.1.2.x (unknown exact version in the sources)

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-83409

## From the sources

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SAML to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_