External risk intelligence

Oracle Access Manager Authentication Engine Vulnerability Allows Full Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-61065

Oracle Access Manager serves as an identity and access management solution that is designed to be public-facing to handle authentication requests. Because it is an unauthenticated, network-accessible service often positioned at the network edge to facilitate user access, it is considered a very likely internet-facing service in common deployment patterns.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability affects Oracle Access Manager, a component of Oracle Fusion Middleware. It allows an unauthenticated attacker with network access to potentially compromise the system, leading to a complete takeover of the Oracle Access Manager. The high CVSS score of 9.8 indicates a critical severity with significant impacts on confidentiality, integrity, and availability.

Unauthenticated attackers can take over Oracle Access Manager.
Critical security flaw in a key identity and access product.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can target Oracle Access Manager by exploiting a vulnerability in its authentication engine. This vulnerability requires no prior authentication and can be accessed over a network using HTTP. A successful attack allows an attacker to gain complete control of the Oracle Access Manager.

No authentication required.
Network access via HTTP.
Full takeover of the product.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker with network access to take over Oracle Access Manager, potentially impacting authentication services.

System authentication data could be at risk.
Unauthenticated network access could lead to exposure.
Complete takeover of the access manager.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-World Ownership

Given that Oracle Access Manager handles authentication and is often internet-facing, teams responsible for identity management, application infrastructure, and network security should collaborate. The first practical step is to pinpoint all Oracle Access Manager instances, determine their business criticality and network exposure, and identify the specific teams or individuals accountable for each. This will enable a risk-based approach to planning remediation, potentially involving vendor coordination for patching or the implementation of temporary mitigations if immediate fixes are not feasible.

Identity and Application Infrastructure teams own the issue.
Verify all Oracle Access Manager instance exposures.
Plan coordinated remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle Access Manager?

Oracle Access Manager is a core component of Oracle Fusion Middleware used to manage identity and access services. It acts as a gatekeeper, verifying user identities and controlling access to enterprise applications. Because it processes authentication requests, it is a foundational piece of security infrastructure for organizations.

What does this CVE mean for the Authentication Engine?

This vulnerability is a critical flaw within the system that processes login credentials. It effectively bypasses security controls, allowing an attacker to interact with the engine without providing valid credentials. This weakness grants unauthorized access, potentially leading to a complete system takeover by an unauthenticated user.

How can an attacker trigger this vulnerability?

An attacker triggers the vulnerability by sending specially crafted HTTP requests over a network. Because it is unauthenticated, no prior login or session is needed to initiate the attack. However, the flaw cannot be triggered by someone without network reachability to the application; it requires that the attacker be able to communicate directly with the service's HTTP interface.

Is my instance of Oracle Access Manager at risk?

Halo Surface Signal indicates that Oracle Access Manager is very likely to be an internet-facing service because of its role in handling authentication. If your deployment is exposed to the public internet, it faces a higher level of risk. You should review your network configuration to determine if the specific instance is reachable from external sources.

When should I prioritize responding to CVE-2026-61065?

You should prioritize this immediately, as the flaw allows for full system takeover. Your first step is to create a complete inventory of all Oracle Access Manager instances to confirm which are active. Once identified, coordinate with your identity and infrastructure teams to assess network exposure and implement vendor-supplied security updates.

References

www.oracle.com/security-alerts/cpujul2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.