Live › vulnerability › CVE-2026-87251
Go to dashboardOracle Access Manager's Authentication Engine (Fusion Middleware) has an unauthenticated, network-reachable flaw via SAML. Oracle rates it CVSS 3.1 9.8 and says it can result in takeover of Access Manager. Fixed in Oracle's October 2026 Critical Patch Update. Oracle gives no root cause. No public exploit or in-the-wild exploitation found.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| Oracle Access Manager | vendor | 12.2.1.4.0, 14.1.2.0.0, 14.1.2.1.0 | October 2026 CPU patch (number on MOS) |
12.2.1.4.0, 14.1.2.0.0 (listed in the CPU advisory table) and 14.1.2.1.0 (named in the CVE record)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SAML to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
This page as .md · .json · in your agent: get_signal("CVE-2026-87251")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.