Oracle Access Manager Flaw Rated Critical CVSS 10.0 Allows Unauthenticated Remote Compromise

A critical vulnerability in Oracle Access Manager, part of Oracle Fusion Middleware, allows unauthenticated attackers to fully compromise the system via HTTP. The flaw, tracked as CVE-2026-87337, carries a CVSS 3.1 base score of 10.0, indicating severe risk to confidentiality and integrity.

The vulnerability resides within the Authentication Engine component of the product. According to the National Vulnerability Database, the issue is easily exploitable and requires no user interaction. Attackers with network access can leverage this flaw to gain unauthorized access to critical data or all data accessible through Oracle Access Manager.

Technical Scope and Impact

The CVSS vector for CVE-2026-87337 is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. This vector indicates that the attack is remote, has low complexity, and requires no privileges or user interaction. The scope of the vulnerability changes upon exploitation, meaning attacks may significantly impact additional products beyond just Oracle Access Manager.

Successful attacks can result in unauthorized creation, deletion, or modification of access to critical data. This includes complete access to all Oracle Access Manager accessible data. The high impact on confidentiality and integrity underscores the severity of the potential data breach and system compromise.

Affected Versions and Products

The vulnerability specifically affects two supported versions of Oracle Access Manager: 12.2.1.4.0 and 14.1.2.1.0. These versions are part of the broader Oracle Fusion Middleware suite. Organizations running these specific releases are at immediate risk if their systems are exposed to network access via HTTP.

The flaw is located in the Authentication Engine, a critical component responsible for verifying user identities. Because the vulnerability allows unauthenticated access, any entity with network connectivity to the affected service can potentially exploit it. The scope change aspect suggests that the impact could extend to other integrated products within the middleware environment.

What should you do?

Organizations should immediately verify if they are running the affected versions of Oracle Access Manager. If these versions are in use, network access via HTTP should be restricted to trusted sources only. Monitoring for unauthorized access attempts and data modifications is essential until a mitigation strategy is confirmed.

What to do and how to stay safe: Oracle

• Audit your environment to identify if Oracle Access Manager versions 12.2.1.4.0 or 14.1.2.1.0 are deployed.
• Restrict network access to the Oracle Access Manager Authentication Engine via HTTP to only trusted IP addresses.
• Monitor logs for unusual authentication attempts or unauthorized data modifications from unauthenticated sources.
• Prepare to apply vendor updates once available, but do not assume a patch exists until officially announced.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Oracle Access Manager are affected by CVE-2026-87337?

The vulnerability affects supported versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Access Manager.

What is the CVSS score for this vulnerability?

CVE-2026-87337 has a CVSS 3.1 Base Score of 10.0, rated as Critical.

Can an attacker exploit this vulnerability without authentication?

Yes, the vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the system.