External risk intelligence

Oracle Access Manager Authentication Engine Remote Data Corruption and Unauthorized Access

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-87337

Oracle Access Manager is an identity and access management solution that is specifically designed to be public-facing to handle authentication and identity services for users and applications. As it functions as an identity portal and gateway accessible over HTTP, it is inherently intended for exposure to the network edge in normal deployments.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle Access Manager, a component of Oracle Fusion Middleware. This issue is easily exploitable by unauthenticated attackers over the network, potentially leading to unauthorized access or modification of critical data within Oracle Access Manager and other connected products. The high severity indicates a significant potential impact on data confidentiality and integrity.

Unauthenticated network attackers can compromise access management.
Leadership should remember this affects secure data access.
Confirm relevance and potential exposure to Oracle Access Manager.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker with network access can compromise Oracle Access Manager by exploiting a vulnerability in its Authentication Engine. This could lead to unauthorized data modification or complete access to all data within Oracle Access Manager, potentially impacting other connected products.

No authentication required.
Network access via HTTP.
Unauthorized data access and modification.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker with network access via HTTP could exploit this vulnerability in Oracle Access Manager. This could lead to unauthorized creation, deletion, or modification of critical data, or complete unauthorized access to all data accessible through Oracle Access Manager, potentially impacting other connected products.

Critical data or all accessible data.
Network access via HTTP.
Unauthorized access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

Oracle Access Manager, as a component of Oracle Fusion Middleware, is likely managed by platform or infrastructure teams due to its role in authentication and access control. The first action should be to identify all instances of Oracle Access Manager within your environment, determine their network exposure, and assess their criticality to business operations. Once identified and prioritized, engage the accountable system owners to plan remediation, which may involve coordination with Oracle or a vendor-management team.

Platform and infrastructure teams should own.
Verify network exposure and criticality.
Plan coordinated remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle Access Manager?

Oracle Access Manager is a core component of Oracle Fusion Middleware. It serves as an identity and access management solution, acting as a gateway that handles authentication requests and identity services for users and various enterprise applications.

What does CVE-2026-87337 mean for my data?

This vulnerability represents a critical flaw in the product's Authentication Engine. It allows an unauthorized actor to bypass typical login security to modify, delete, or steal sensitive information. Because the flaw can impact systems connected to the manager, it poses a risk to the integrity of data across your integrated environment.

How can an attacker trigger this vulnerability?

An attacker initiates the exploit by sending specifically crafted HTTP requests over the network. Crucially, the attacker does not need any valid login credentials or user accounts to trigger the flaw. The vulnerability is tied specifically to the authentication engine's processing of these network requests.

Is my Oracle Access Manager installation at risk?

Halo Surface Signal notes that Oracle Access Manager is often deployed as a public-facing portal to facilitate identity services. If your instance is accessible over the network, it is inherently positioned at the edge, increasing the likelihood that it could be targeted by unauthorized actors.

How should I respond to this threat?

Start by locating all instances of Oracle Access Manager in your environment and verifying their specific network configurations. Once identified, work with the system owners to prioritize these assets based on their role in your infrastructure and coordinate with your vendor-management or security teams to plan the necessary updates.

References

www.oracle.com/security-alerts/cpuoct2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.