---
id: "CVE-2026-87251"
kind: "vulnerability"
aliases: ["CVE-2026-87251"]
title: "Oracle Access Manager: unauthenticated SAML flaw allows full takeover"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Oracle Access Manager", "fixed": ["October 2026 CPU patch (number on MOS)"], "affected": "12.2.1.4.0, 14.1.2.0.0, 14.1.2.1.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["oracle-access-manager", "oracle-fusion-middleware", "runtime", "saml", "self-hosted", "sso"]
not_affected_if: ["managed-hosting", "saml-disabled", "unknown"]
published_at: "2026-10-20T22:20:05+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-23T23:03:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87251", "first_seen_at": "2026-10-23T21:57:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:03:57+00:00"}]
---

# Oracle Access Manager: unauthenticated SAML flaw allows full takeover

Oracle Access Manager's Authentication Engine (Fusion Middleware) has an unauthenticated, network-reachable flaw via SAML. Oracle rates it CVSS 3.1 9.8 and says it can result in takeover of Access Manager. Fixed in Oracle's October 2026 Critical Patch Update. Oracle gives no root cause. No public exploit or in-the-wild exploitation found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Access Manager affected 12.2.1.4.0, 14.1.2.0.0, 14.1.2.1.0 fixed October 2026 CPU patch (number on MOS)

## How to check

Find your Access Manager version (for example with OPatch: $ORACLE_HOME/OPatch/opatch lsinventory, or the WebLogic/OAM console). Affected: 12.2.1.4.0, 14.1.2.0.0 (listed in the CPU advisory table) and 14.1.2.1.0 (named in the CVE record). Then check whether SAML/federation is enabled and the OAM server is reachable from untrusted networks. Oracle gives no detection command.

## Fix

Apply the October 2026 Critical Patch Update for Oracle Fusion Middleware / Oracle Access Manager. Get the exact patch number from the Fusion Middleware patch availability document on My Oracle Support (login required). Oracle published no workaround. Until patched, restrict network access to OAM SAML endpoints.

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87251
- 2026-10-23T23:03:57+00:00 analyst — Oracle CPU Oct 2026 (cpuoct2026.html) lists Oracle Access Manager 12.2.1.4.0, 14.1.2.0.0, 14.1.2.1.0 under Fusion Middleware; Rapid7 gives CVSS 9.8, not in KEV, EPSS 0%. Per-CVE patch number is behind My Oracle Support (login) so exact patch ID is unknown. No PoC found, no X posts. Sibling CVE-2026-87337 (HTTP, CVSS 10) is a separate flaw in the same component.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] Rapid7 DB: CVE-2026-87251 (CVSS 9.8, not in KEV) https://www.rapid7.com/db/vulnerabilities/cve-2026-87251/

## From the sources

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SAML to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_