CVE-2026-83369: Oracle Access Manager Partial DOS Vulnerability

CVE-2026-83369 Overview

CVE-2026-83369 is a denial of service vulnerability in the Access SDK component of Oracle Access Manager, part of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with network access via HTTP can exploit the issue to cause a partial denial of service against Oracle Access Manager. Exploitation is difficult and requires specific conditions to succeed, but no user interaction is needed. Oracle addressed the issue in the Oracle Security Alert bulletin CSPUSEP2026.

Critical Impact
Successful exploitation results in partial availability loss of Oracle Access Manager, which brokers authentication for downstream Fusion Middleware applications.

Affected Products

Oracle Access Manager 12.2.1.4.0 (Access SDK component)
Oracle Access Manager 14.1.2.1.0 (Access SDK component)
Oracle Fusion Middleware deployments integrating the Access SDK

Discovery Timeline

2026-09-15 - CVE-2026-83369 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-83369

Vulnerability Analysis

The vulnerability resides in the Access SDK component of Oracle Access Manager. The Access SDK exposes programmatic interfaces used by custom agents and integrations to interact with the Oracle Access Manager (OAM) server over HTTP. An authenticated attacker with limited privileges can send crafted requests through this interface to trigger a condition that degrades availability of OAM services.

Oracle categorizes the impact as partial denial of service, meaning the service degrades but does not fully collapse. The scope remains unchanged, and no confidentiality or integrity impact is reported. Exploitation complexity is high, which typically indicates a race condition, dependence on specific runtime state, or non-trivial preconditions. The vulnerability is limited to availability, but any degradation of OAM directly affects downstream applications that rely on OAM for single sign-on and access enforcement.

Root Cause

Oracle has not published the underlying code defect. The Access SDK component processes attacker-influenced input over HTTP in a manner that permits resource contention or exception-driven degradation. No CWE has been assigned in the published advisory.

Attack Vector

Exploitation requires network access to the OAM HTTP interface and valid low-privilege credentials. The attacker sends specifically crafted requests through the Access SDK-exposed endpoints. Because the attack complexity is high, the attacker must satisfy timing or state conditions outside their direct control. No user interaction is required.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.231%, placing exploitation probability in the lower tier of tracked vulnerabilities.

Refer to the Oracle Security Alert: CSPUSEP2026 for vendor-supplied technical context.

Detection Methods for CVE-2026-83369

Indicators of Compromise

Repeated HTTP requests to Oracle Access Manager Access SDK endpoints originating from a single low-privileged principal
OAM server logs showing spikes in exceptions, request queue depth, or thread exhaustion tied to Access SDK processing
Intermittent authentication or SSO failures for applications that depend on OAM without corresponding infrastructure faults

Detection Strategies

Baseline normal Access SDK request patterns and alert on statistically anomalous request rates from authenticated sessions
Correlate OAM availability degradation with authenticated HTTP request sources to isolate potential abuse
Enable verbose logging on the OAM managed servers hosting the Access SDK during incident triage

Monitoring Recommendations

Forward OAM AdminServer and managed server logs to a centralized analytics platform for correlation
Monitor JVM thread pool saturation, GC pressure, and request latency on OAM instances
Track authentication success and failure rates for downstream applications to detect availability degradation early

How to Mitigate CVE-2026-83369

Immediate Actions Required

Apply the patches referenced in the Oracle Security Alert: CSPUSEP2026 to Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0
Inventory all OAM deployments and confirm which host the affected Access SDK component
Review authenticated accounts with access to Access SDK endpoints and remove unnecessary privileges

Patch Information

Oracle published fixes for CVE-2026-83369 as part of the CSPUSEP2026 security alert. Apply the vendor-supplied patches for Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 following Oracle's documented Fusion Middleware patching procedures. Validate patch application in a non-production environment before rollout.

Workarounds

Restrict network reachability to OAM Access SDK endpoints to trusted application tiers using firewall rules or a reverse proxy
Enforce rate limiting on HTTP requests to Access SDK endpoints at the network edge
Rotate and audit credentials for any low-privilege accounts that can authenticate to OAM until patches are deployed

bash

# Example: restrict Access SDK endpoint exposure at the reverse proxy
# Allow only trusted application subnets to reach the OAM Access SDK path
location /oam/ {
    allow 10.10.20.0/24;   # trusted application tier
    deny  all;
    proxy_pass http://oam_backend;
    limit_req zone=oam_sdk burst=20 nodelay;
}