CVE-2026-87251: Oracle Access Manager Auth Bypass Flaw

CVE-2026-87251 Overview

CVE-2026-87251 is an authentication flaw [CWE-287] in the Oracle Access Manager component of Oracle Fusion Middleware. The vulnerability resides in the Authentication Engine and is exploitable over the network through Security Assertion Markup Language (SAML) processing. An unauthenticated remote attacker can compromise Oracle Access Manager without user interaction. Successful exploitation leads to full takeover of Oracle Access Manager, impacting confidentiality, integrity, and availability. Oracle addressed the issue in the October 2026 Critical Patch Update.

Critical Impact
Unauthenticated network attackers can take over Oracle Access Manager through crafted SAML requests, compromising the identity and single sign-on infrastructure for downstream applications.

Affected Products

Oracle Access Manager 12.2.1.4.0
Oracle Access Manager 14.1.2.1.0
Oracle Fusion Middleware (Authentication Engine component)

Discovery Timeline

2026-10-20 - CVE CVE-2026-87251 published to the National Vulnerability Database (NVD)
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-87251

Vulnerability Analysis

The flaw sits in the Authentication Engine of Oracle Access Manager, the component responsible for processing federated authentication assertions. Oracle Access Manager functions as the central single sign-on and policy enforcement service across Oracle Fusion Middleware deployments. A weakness in how the engine validates inbound SAML messages allows an unauthenticated attacker to bypass authentication controls and gain administrative control of the service.

Because Oracle Access Manager governs access to downstream enterprise applications, compromise of the service extends well beyond the host. An attacker who takes over the service can impersonate arbitrary users, mint valid session tokens, and pivot into protected applications. The vulnerability carries a CWE-287 classification for Improper Authentication.

Root Cause

The root cause is improper validation within the SAML processing path of the Authentication Engine. Oracle has not published low-level technical details, but the CWE-287 mapping indicates that authentication checks on inbound SAML assertions are missing or incorrectly enforced. Weaknesses of this class typically include failures in signature verification, assertion scope validation, or trust evaluation of the issuing identity provider.

Attack Vector

Exploitation requires only network reachability to the Oracle Access Manager SAML endpoint. The attacker sends a crafted SAML message to the Authentication Engine and does not need credentials or user interaction. Any Oracle Access Manager instance exposed to untrusted networks, including internet-facing deployments supporting federation, is directly reachable by remote attackers.

No verified public exploit code or proof-of-concept has been published at the time of writing. The Exploit Prediction Scoring System (EPSS) data for this CVE is available in the NVD record.

See the Oracle Critical Patch Update - October 2026 for Oracle's advisory.

Detection Methods for CVE-2026-87251

Indicators of Compromise

Unexpected administrative sessions or configuration changes within Oracle Access Manager audit logs.
Inbound SAML assertions from unknown issuers or with malformed signature elements reaching the /oam or federation endpoints.
New or modified authentication policies, identity providers, or trusted partners in the Oracle Access Manager configuration store.
Session tokens issued to users without a corresponding successful primary authentication event.

Detection Strategies

Enable verbose audit logging on the Oracle Access Manager Authentication Engine and forward logs to a central security data lake for correlation.
Alert on SAML responses that fail signature validation yet produce successful authentication outcomes.
Baseline normal federation partner activity and flag assertions from unexpected Issuer values or endpoints.
Correlate Oracle Access Manager session issuance with downstream application access to identify tokens that bypass expected authentication flows.

Monitoring Recommendations

Monitor the Oracle Access Manager admin console and WebLogic management interfaces for unauthorized configuration changes.
Track network traffic to Oracle Access Manager SAML endpoints and alert on request volume spikes or anomalous source addresses.
Review web application firewall logs for malformed or oversized SAML payloads targeting the Authentication Engine.

How to Mitigate CVE-2026-87251

Immediate Actions Required

Apply the October 2026 Oracle Critical Patch Update to all Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 instances without delay.
Inventory every Oracle Access Manager deployment, including non-production environments, and confirm patch status.
Restrict network access to Oracle Access Manager SAML endpoints to known federation partners where feasible.
Rotate signing keys, administrative credentials, and session secrets after patching if compromise is suspected.

Patch Information

Oracle released fixes for CVE-2026-87251 in the October 2026 Critical Patch Update. Patch details, download links, and compatibility notes are available in the Oracle Critical Patch Update - October 2026 advisory. Oracle recommends applying Critical Patch Update fixes without delay given the unauthenticated network attack vector.

Workarounds

No vendor-supplied workaround removes the vulnerability; patching is the only complete remediation.
Place Oracle Access Manager behind a reverse proxy or web application firewall that enforces strict SAML schema validation and signature checks.
Limit exposure of federation endpoints to allow-listed identity provider networks until patching is complete.
Increase logging and alerting on authentication and configuration events during the remediation window.

bash

# Example: restrict access to Oracle Access Manager SAML endpoints at the reverse proxy
# (adjust CIDR ranges to match trusted identity provider networks)
location /oam/fed {
    allow 203.0.113.0/24;   # Trusted IdP network
    allow 198.51.100.0/24;  # Partner federation network
    deny all;
    proxy_pass https://oam-backend.internal;
}