CVE-2026-70905: Oracle Access Manager Auth Bypass Vulnerability

CVE-2026-70905 Overview

CVE-2026-70905 is an authentication vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware. The flaw resides in the Agent infrastructure and is exposed through the Security Assertion Markup Language (SAML) processing path. An unauthenticated remote attacker with network access can exploit the weakness to fully take over Oracle Access Manager. Affected supported versions are 12.2.1.4.0 and 14.1.2.1.0. The vulnerability is categorized under [CWE-287] Improper Authentication and impacts confidentiality, integrity, and availability.

Critical Impact
Unauthenticated attackers can compromise Oracle Access Manager over the network via crafted SAML messages, resulting in full product takeover.

Affected Products

Oracle Access Manager 12.2.1.4.0
Oracle Access Manager 14.1.2.1.0
Oracle Fusion Middleware deployments using the Agent infrastructure component

Discovery Timeline

2026-08-18 - CVE-2026-70905 published to NVD
2026-08-22 - Last updated in NVD database
Vendor advisory: Oracle Security Alert - August 2026

Technical Details for CVE-2026-70905

Vulnerability Analysis

The vulnerability affects the Agent infrastructure of Oracle Access Manager (OAM), which brokers authentication between protected applications and identity providers. Oracle Access Manager consumes SAML assertions to establish authenticated sessions for federated users. A flaw in how OAM validates or authenticates SAML input allows an attacker to bypass identity verification and gain control of the OAM instance.

Because Oracle Access Manager sits at the front of many enterprise application stacks, compromise cascades to every downstream application relying on OAM for single sign-on. An attacker who takes over OAM can mint sessions, impersonate any user, and pivot into internal applications.

The issue is remotely exploitable with no authentication and no user interaction. Oracle rates the impact as full loss of confidentiality, integrity, and availability of the Access Manager product.

Root Cause

Oracle classifies the root cause under [CWE-287] Improper Authentication. The Agent infrastructure fails to correctly authenticate SAML-based requests, allowing forged or manipulated assertions to be accepted as valid. Oracle has not published low-level technical details of the parsing or signature validation defect. Refer to the Oracle Security Alert - August 2026 for vendor-supplied details.

Attack Vector

The attack vector is network-based through the SAML endpoints exposed by Oracle Access Manager. An attacker sends a crafted SAML message to a reachable OAM Agent interface. No credentials, prior access, or user interaction are required. Successful exploitation yields full compromise of the Oracle Access Manager instance and any authentication contexts it manages.

No public proof-of-concept exploit is available at time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.473%.

Detection Methods for CVE-2026-70905

Indicators of Compromise

Unexpected SAML assertion processing entries in Oracle Access Manager logs originating from unfamiliar external IP addresses.
New administrative sessions, agent registrations, or policy modifications in OAM without a corresponding change ticket.
Federated login events for privileged accounts lacking a matching identity provider authentication event.
Outbound connections from OAM hosts to non-approved destinations following inbound SAML traffic.

Detection Strategies

Inspect Oracle Access Manager audit logs for malformed, unsigned, or unexpectedly signed SAML assertions reaching Agent endpoints.
Correlate SAML Response and Assertion events with upstream identity provider logs to identify assertions with no matching IdP issuance.
Alert on authentication events for high-privilege users that skip expected multi-factor prompts or originate from unusual network paths.

Monitoring Recommendations

Forward OAM oam-server and access audit logs to a centralized analytics platform for retention and correlation.
Baseline normal SAML request volume, source ASN distribution, and assertion issuer values, and alert on deviations.
Monitor changes to OAM configuration objects, agent profiles, and identity federation partners for unauthorized modifications.

How to Mitigate CVE-2026-70905

Immediate Actions Required

Apply the fixes from the Oracle Security Alert - August 2026 to all Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 deployments.
Restrict network exposure of OAM Agent and SAML endpoints to trusted networks and identity provider IP ranges only.
Rotate OAM administrative credentials, agent shared secrets, and any signing or encryption keys used for federation.
Review OAM audit logs for the preceding 90 days to identify potential prior exploitation attempts.

Patch Information

Oracle addressed CVE-2026-70905 in the August 2026 Security Alert. Administrators should install the patches published in the Oracle Security Alert - August 2026 advisory for the affected Oracle Fusion Middleware releases. Oracle recommends applying Critical Patch Update fixes without delay, and no supported downgrade path exists for the vulnerable versions.

Workarounds

Place Oracle Access Manager behind a web application firewall configured to validate SAML message structure and reject malformed assertions.
Restrict inbound access to OAM SAML endpoints using network access control lists to only known identity providers.
Enforce strict signature validation and certificate pinning for all configured SAML federation partners.
Disable unused SAML profiles and federation partners to reduce attack surface until patches are applied.

bash

# Configuration example: restrict OAM SAML endpoint exposure at the network edge
# Replace <IDP_IP> with your identity provider address and <OAM_HOST> with the OAM server
iptables -A INPUT -p tcp --dport 14100 -s <IDP_IP> -d <OAM_HOST> -j ACCEPT
iptables -A INPUT -p tcp --dport 14100 -d <OAM_HOST> -j DROP