{"id":"CVE-2026-87296","kind":"vulnerability","aliases":["CVE-2026-87296"],"related":[],"title":"Oracle Access Manager: unauthenticated HTTP flaw exposes critical data","description":"Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).","summary":"Oracle Access Manager's Authentication Engine, in versions 12.2.1.4.0 and 14.1.2.1.0, has a flaw that an unauthenticated attacker can reach over HTTP from the network. A successful attack gives unauthorized access to critical data held by Oracle Access Manager.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["oracle-access-manager","oracle-fusion-middleware","runtime","self-hosted"],"not_affected_if":["unaffected-version"],"how_to_check":"- Check the installed Oracle Access Manager version against `12.2.1.4.0` and `14.1.2.1.0`\n- Confirm whether Oracle Access Manager is reachable over HTTP from untrusted networks","fix":"- Apply the Oracle Critical Patch Update fix for Oracle Access Manager that covers CVE-2026-87296 (patch identifier unknown from the sources)","status":"open","published_at":"2026-10-20T22:20:06+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-25T03:18:51+00:00","updated_at":"2026-10-25T03:18:51+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T03:18:51Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the Oracle Critical Patch Update fix for Oracle Access Manager that covers CVE-2026-87296 (patch identifier unknown from the sources)","reach":"internet","title":"Oracle Access Manager: unauthenticated HTTP flaw exposes critical data","impact":"medium","summary":"Oracle Access Manager's Authentication Engine, in versions 12.2.1.4.0 and 14.1.2.1.0, has a flaw that an unauthenticated attacker can reach over HTTP from the network. A successful attack gives unauthorized access to critical data held by Oracle Access Manager.","category":"runtime","nicknames":[],"who_cares":["oracle-access-manager","oracle-fusion-middleware","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated remote attacker reads critical data from Oracle Access Manager","analyst_note":"Find the Oracle Critical Patch Update advisory and the patch identifier for CVE-2026-87296, and confirm the exact data exposed.","how_to_check":"- Check the installed Oracle Access Manager version against `12.2.1.4.0` and `14.1.2.1.0`\n- Confirm whether Oracle Access Manager is reachable over HTTP from untrusted networks","needs_analyst":true,"not_affected_if":["unaffected-version"],"who_is_affected":"Teams that run Oracle Access Manager 12.2.1.4.0 or 14.1.2.1.0 as part of Oracle Fusion Middleware, especially where its HTTP endpoints face the network. The sources do not say which configurations or deployment modes are required, so teams on other versions can likely skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000662,"input_tokens":3474,"output_tokens":630,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-87296':12A,15A '/av':140C '12.2.1.4.0':36B,87C '14.1.2.1.0':38B,89C '3.1':130C,139C '7.5':133C 'access':2A,18B,29B,58B,65B,71C,98C,104C,115C,121C,125C,127C 'affect':85C 'allow':93C 'attack':45B,55B,95C,107C 'authent':32B,79C 'base':131C 'complet':120C 'compon':78C 'compromis':102C 'confidenti':134C 'critic':8A,60B,117C 'cve':10A,13A 'cvss':129C,136C,138C 'data':9A,61B,118C,128C 'easili':90C 'engin':33B,80C 'exploit':91C 'expos':7A 'flaw':6A,41B 'fusion':22B,76C 'give':56B 'h/i':146C 'held':62B 'host':27B 'http':5A,49B,100C 'impact':135C 'l/pr':142C 'manag':3A,19B,30B,66B,72C,105C,126C 'middlewar':23B,77C 'n':148C 'n/a':147C 'n/ac':141C 'n/s':144C 'n/ui':143C 'network':52B,97C 'oracl':1A,17B,21B,28B,64B,70C,75C,103C,124C 'oracle-access-manag':16B 'oracle-fusion-middlewar':20B 'product':73C 'reach':47B 'result':112C 'runtim':24B 'score':132C 'self':26B 'self-host':25B 'success':54B,106C 'support':81C 'u/c':145C 'unauthent':4A,44B,94C 'unauthor':57B,114C 'vector':137C 'version':35B,82C 'via':99C 'vulner':67C,92C,110C","nicknames":[],"mitigations":[],"who_affected":"Teams that run Oracle Access Manager 12.2.1.4.0 or 14.1.2.1.0 as part of Oracle Fusion Middleware, especially where its HTTP endpoints face the network. The sources do not say which configurations or deployment modes are required, so teams on other versions can likely skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:20:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-87296","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87296","severity":null,"published_at":"2026-10-20T22:20:06+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}