{"id":"CVE-2026-87251","kind":"vulnerability","aliases":["CVE-2026-87251"],"related":[],"title":"Oracle Access Manager: unauthenticated SAML flaw allows full takeover","description":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SAML to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Access Manager's Authentication Engine (Fusion Middleware) has an unauthenticated, network-reachable flaw via SAML. Oracle rates it CVSS 3.1 9.8 and says it can result in takeover of Access Manager. Fixed in Oracle's October 2026 Critical Patch Update. Oracle gives no root cause. No public exploit or in-the-wild exploitation found.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Access Manager","fixed":["October 2026 CPU patch (number on MOS)"],"affected":"12.2.1.4.0, 14.1.2.0.0, 14.1.2.1.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle-access-manager","oracle-fusion-middleware","runtime","saml","self-hosted","sso"],"not_affected_if":["managed-hosting","saml-disabled","unknown"],"how_to_check":"Find your Access Manager version (for example with OPatch: $ORACLE_HOME/OPatch/opatch lsinventory, or the WebLogic/OAM console). Affected: 12.2.1.4.0, 14.1.2.0.0 (listed in the CPU advisory table) and 14.1.2.1.0 (named in the CVE record). Then check whether SAML/federation is enabled and the OAM server is reachable from untrusted networks. Oracle gives no detection command.","fix":"Apply the October 2026 Critical Patch Update for Oracle Fusion Middleware / Oracle Access Manager. Get the exact patch number from the Fusion Middleware patch availability document on My Oracle Support (login required). Oracle published no workaround. Until patched, restrict network access to OAM SAML endpoints.","status":"open","published_at":"2026-10-20T22:20:05+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-23T22:34:42+00:00","updated_at":"2026-10-23T23:03:57+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-10-23T22:34:42Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Oracle Critical Patch Update fix for CVE-2026-87251 from Oracle's advisory; sources do not name the patched version.","reach":"internet","title":"Oracle Access Manager: unauthenticated SAML flaw allows full takeover","impact":"high","summary":"Oracle Access Manager's Authentication Engine in Fusion Middleware 12.2.1.4.0 and 14.1.2.1.0 has a flaw reachable over the network via SAML. An unauthenticated attacker can take over the Access Manager server.","category":"runtime","who_cares":["oracle-access-manager","oracle-fusion-middleware","saml","sso"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker takes over the Access Manager server without credentials.","analyst_note":"Find Oracle's advisory for CVE-2026-87251 to get the patched version and whether SAML must be enabled to be exposed.","how_to_check":"Confirm the Oracle Access Manager version with the installed product (12.2.1.4.0 or 14.1.2.1.0 are affected); check whether SAML is enabled on the deployment. Sources do not give a command.","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000544,"input_tokens":3089,"output_tokens":471,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find Oracle's Critical Patch Update advisory for this CVE to get the patch version and any mitigation steps; sources give only the NVD record.","search":"'-2026':11A,14A '-87251':12A,15A '/av':156C '12.2.1.4.0':110C '14.1.2.1.0':112C '2026':71B '3.1':54B,143C,155C '9.8':55B,146C 'access':2A,17A,21B,34B,64B,94C,121C,127C,140C 'affect':108C 'allow':7A,116C 'attack':118C,130C 'authent':37B,102C 'avail':150C 'base':144C 'caus':79B 'compon':101C 'compromis':125C 'confidenti':147C 'critic':72B 'cve':10A,13A 'cvss':53B,142C,152C,154C 'easili':113C 'engin':38B,103C 'exploit':82B,88B,114C 'fix':66B 'flaw':6A,47B 'found':89B 'full':8A 'fusion':25B,39B,99C 'give':76B 'h':164C 'h/a':163C 'h/i':162C 'host':31B 'impact':151C 'in-the-wild':84B 'integr':148C 'l/pr':158C 'manag':3A,22B,35B,65B,95C,128C,141C 'manager':18A 'middlewar':26B,40B,100C 'n/ac':157C 'n/s':160C 'n/ui':159C 'network':45B,120C 'network-reach':44B 'octob':70B 'oracl':1A,20B,24B,33B,50B,68B,75B,93C,98C,126C,139C 'oracle':16A 'oracle-access-manag':19B 'oracle-fusion-middlewar':23B 'patch':73B 'product':96C 'public':81B 'rate':51B 'reachabl':46B 'result':60B,135C 'root':78B 'runtim':27B 'saml':5A,28B,49B,123C 'say':57B 'score':145C 'self':30B 'self-host':29B 'sso':32B 'success':129C 'support':104C 'takeov':9A,62B,137C 'u/c':161C 'unauthent':4A,43B,117C 'updat':74B 'vector':153C 'version':105C 'via':48B,122C 'vulner':90C,115C,133C 'wild':87B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87251","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87251","severity":null,"published_at":"2026-10-20T22:20:05+00:00","modified_at":"2026-10-21T18:44:55+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-87251:359","url":null,"severity":null,"published_at":"2026-10-23T23:03:57+00:00","modified_at":"2026-10-23T23:03:57+00:00","first_seen_at":"2026-10-23T23:03:57+00:00","fetched_at":"2026-10-23T23:03:57+00:00","note":"Oracle CPU Oct 2026 (cpuoct2026.html) lists Oracle Access Manager 12.2.1.4.0, 14.1.2.0.0, 14.1.2.1.0 under Fusion Middleware; Rapid7 gives CVSS 9.8, not in KEV, EPSS 0%. Per-CVE patch number is behind My Oracle Support (login) so exact patch ID is unknown. No PoC found, no X posts. Sibling CVE-2026-87337 (HTTP, CVSS 10) is a separate flaw in the same component."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1761,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-87251/","title":"Rapid7 DB: CVE-2026-87251 (CVSS 9.8, not in KEV)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}