External risk intelligence

Oracle Access Manager Authentication Engine Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-87251

Oracle Access Manager is an identity management and authentication gateway. As it handles SAML authentication requests and is designed to sit at the network edge to manage access to enterprise resources, it is typically deployed as a public-facing service or an internet-reachable identity portal.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle Access Manager, a component of Oracle Fusion Middleware used for authentication. This issue, which is easily exploitable by an unauthenticated attacker over the network via SAML, could lead to a complete takeover of the Access Manager system, impacting confidentiality, integrity, and availability. The primary concern is confirming if this technology is in use and if it is exposed.

Unauthenticated access to Oracle Access Manager.
Controls user access to enterprise applications.
Confirm relevance and exposure; assess potential impact.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker with network access can target Oracle Access Manager's Authentication Engine. By sending SAML requests, the attacker can exploit a vulnerability, potentially leading to a complete takeover of the system and compromising its confidentiality, integrity, and availability.

Network access required.
SAML requests trigger vulnerability.
Full system takeover risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker with network access to completely take over Oracle Access Manager when it handles SAML authentication requests. This could expose sensitive information and impact the integrity and availability of the system.

Compromise of Oracle Access Manager.
Attacker gains network access via SAML.
Full system takeover and data compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in Oracle Access Manager, an authentication engine, is easily exploitable by unauthenticated attackers via SAML. Given its role as an identity management and authentication gateway, it is likely deployed as a public-facing service. The first practical step is to identify all instances of Oracle Access Manager, confirm their network reachability and business criticality, and then assign an accountable owner for remediation planning.

Identify affected Oracle Access Manager instances.
Verify network exposure and business criticality.
Plan remediation with accountable owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle Access Manager?

Oracle Access Manager is a component of Oracle Fusion Middleware that functions as an identity management and authentication gateway. It serves as a central control point that verifies user identities and manages access permissions across various enterprise applications and web resources.

How does CVE-2026-87251 affect the Authentication Engine?

This vulnerability affects the Authentication Engine within Oracle Access Manager. It represents a flaw that allows an unauthorized party to manipulate the system's processing logic, potentially leading to a full takeover of the application where the attacker gains control over its security, data, and availability.

Do I need to worry if my system does not use SAML?

The vulnerability is triggered specifically when the system handles SAML authentication requests. If your configuration does not utilize SAML-based authentication, this specific trigger path is not available to an attacker, though the software may still be affected if other components are enabled.

Is my Oracle Access Manager instance at risk?

According to Halo Surface Signal, this software is typically deployed as a public-facing service or an internet-reachable identity portal to manage enterprise access. Because it is designed to sit at the network edge, any instance reachable over the network is at higher risk of being targeted by an unauthenticated attacker.

What is the first step to address this CVE?

Start by auditing your environment to identify all active instances of Oracle Access Manager. Verify which of these systems are reachable via the network and determine their business criticality. Once mapped, assign an accountable owner to each instance to prepare for the necessary remediation steps.

References

www.oracle.com/security-alerts/cpuoct2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.