Oracle Access Manager Has Critical SAML Flaw in Versions 12.2.1.4.0 and 14.1.2.1.0

The National Vulnerability Database has published details for CVE-2026-87251, a critical security flaw in Oracle Access Manager. This vulnerability allows an unauthenticated attacker with network access to compromise the system entirely. The issue resides within the Authentication Engine component of Oracle Fusion Middleware.

According to the NVD record, the flaw is easily exploitable and carries a CVSS 3.1 Base Score of 9.8. Successful exploitation results in the complete takeover of the Oracle Access Manager instance. The vector string indicates high impacts on confidentiality, integrity, and availability without requiring user interaction.

Technical Context and Severity

The vulnerability affects specific supported versions of the software, namely 12.2.1.4.0 and 14.1.2.1.0. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) highlights the ease of exploitation. Attackers can leverage network access via the Security Assertion Markup Language (SAML) protocol to initiate the attack.

Because the flaw requires no authentication privileges, any actor with network reachability to the SAML endpoint can attempt exploitation. The "Low" complexity rating for attack conditions suggests that specialized skills or rare conditions are not required to trigger the vulnerability. This makes the threat accessible to a wide range of potential adversaries.

Affected Systems and Scope

Only two specific versions of Oracle Access Manager are listed as affected in the current advisory. Organizations running version 12.2.1.4.0 or version 14.1.2.1.0 are directly exposed to this risk. Other versions of the product are not mentioned in the NVD record as being vulnerable to this specific CVE.

The component identified is the Authentication Engine, which is central to how Oracle Access Manager handles identity verification. Compromising this engine allows attackers to bypass security controls. The result is a full system takeover, granting the attacker control over the access management infrastructure.

What should you do?

Security teams should immediately verify if their Oracle Access Manager installations match the affected version numbers. If the software is running version 12.2.1.4.0 or 14.1.2.1.0, it is vulnerable until a fix is applied. Organizations should restrict network access to the SAML endpoints to reduce the attack surface.

WHAT TO DO:

• Audit your environment to confirm if you are running Oracle Access Manager versions 12.2.1.4.0 or 14.1.2.1.0.
• Restrict network access to SAML endpoints to trusted sources only, limiting exposure to unauthenticated attackers.
• Monitor logs for unusual SAML traffic patterns that may indicate exploitation attempts against the Authentication Engine.
• Wait for official vendor guidance before applying any patches, as no fix has been confirmed yet in this report.

What to do and how to stay safe: Oracle Access Manager

• Vulnerability severity scores ignore your specific architecture and context.
• Exploitability depends on network exposure and user behavior, not just code flaws.
• Prioritization requires continuous asset inventory and threat intelligence alignment.

Risk-based vulnerability management focuses your limited resources on the flaws that actually threaten your business. Start by mapping your critical assets and checking for active exploits to prioritize your backlog.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-87251?

The vulnerability has a CVSS 3.1 Base Score of 9.8, which is rated as critical severity.

Which versions of Oracle Access Manager are affected by this flaw?

Versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Access Manager are affected by this vulnerability.

Does an attacker need credentials to exploit this vulnerability?

No, the vulnerability allows an unauthenticated attacker to compromise the system with only network access via SAML.