Oracle Access Manager Authentication Engine Vulnerability Enables Full Data Access Without Credentials

Oracle Access Manager contains a critical vulnerability in its Authentication Engine that permits unauthenticated remote compromise. This flaw allows attackers with network access via HTTP to bypass security controls entirely. The issue affects specific supported versions of the product within Oracle Fusion Middleware. Security teams should assess their exposure immediately, as the vulnerability enables full control over accessible data without requiring any valid credentials or user interaction.

Root cause

The vulnerability resides specifically within the Authentication Engine component of Oracle Access Manager. According to the NVD record, the flaw is easily exploitable and does not require authentication or user interaction. The CVSS vector indicates that the attack complexity is low and no privileges are required. This design weakness allows an attacker to traverse network boundaries and interact directly with the authentication mechanisms, leading to a significant scope change that impacts additional products beyond the initial target.

Attack path

An attacker initiates the exploit by sending HTTP requests to the affected Oracle Access Manager instance. Because the vulnerability allows unauthenticated access, no valid credentials are needed to begin the attack chain. Once the authentication engine is compromised, the attacker gains unauthorized creation, deletion, or modification rights to critical data. The attack path concludes with complete access to all data accessible by Oracle Access Manager, effectively handing over control of the environment to the remote adversary.

Affected versions

• Oracle Access Manager 12.2.1.4.0
• Oracle Access Manager 14.1.2.1.0

Mitigation

• Verify if your environment runs Oracle Access Manager 12.2.1.4.0 or 14.1.2.1.0.
• Isolate affected instances from untrusted networks if possible.
• Monitor for unauthorized HTTP traffic targeting the authentication endpoints.
• Await official vendor guidance for patches or configuration changes.

Signals worth monitoring

Teams usually observe unusual HTTP traffic patterns originating from external IPs targeting authentication endpoints. Check whether log files show successful access attempts without preceding login sequences or credential validation. Look for sudden spikes in data modification events or unexpected administrative actions performed by anonymous sessions. Monitor for lateral movement indicators where the compromised authentication service attempts to access other internal resources. First containment moves typically involve blocking the source IP addresses at the firewall level and restricting network access to the authentication engine until further analysis is complete.

What to do and how to stay safe: Oracle Access Manager

• Audit your Oracle Access Manager inventory to confirm if versions 12.2.1.4.0 or 14.1.2.1.0 are in use.
• Implement network segmentation to restrict HTTP access to the Authentication Engine from untrusted zones.
• Review HTTP logs for unauthenticated requests that result in successful data access or modification.
• Prepare to isolate affected systems once the vendor provides an update or mitigation guidance.

Step-by-step guide: Out-of-band patches: what small businesses need to know

General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-87337?

The CVSS 3.1 Base Score is 10.0, rated as Critical.

Which Oracle Access Manager versions are affected?

Versions 12.2.1.4.0 and 14.1.2.1.0 are affected.

Does the attacker need credentials to exploit this?

No, the vulnerability allows unauthenticated attackers to compromise the system.