CVE-2026-87296: Oracle Access Manager Auth Bypass Flaw

CVE-2026-87296 Overview

CVE-2026-87296 is a high-severity vulnerability in the Authentication Engine component of Oracle Access Manager, part of Oracle Fusion Middleware. The flaw allows an unauthenticated remote attacker with network access over HTTP to compromise the product. Successful exploitation can result in unauthorized access to critical data or complete read access to all data accessible through Oracle Access Manager. Oracle addressed the issue in the October 2026 Critical Patch Update.

Critical Impact
Unauthenticated network attackers can read sensitive authentication data without user interaction, exposing identity and session information managed by Oracle Access Manager.

Affected Products

Oracle Access Manager 12.2.1.4.0
Oracle Access Manager 14.1.2.1.0
Oracle Fusion Middleware (Authentication Engine component)

Discovery Timeline

2026-10-20 - CVE-2026-87296 published to the National Vulnerability Database
2026-10-21 - Last updated in NVD database
October 2026 - Oracle releases fix as part of the Oracle Critical Patch Update

Technical Details for CVE-2026-87296

Vulnerability Analysis

The vulnerability affects the Authentication Engine component of Oracle Access Manager (OAM), the single sign-on and access control service used across Oracle Fusion Middleware deployments. An attacker can reach the Authentication Engine over HTTP without authentication and without any user interaction. Exploitation requires low attack complexity and does not require elevated privileges on the target system.

The impact is confined to confidentiality. Oracle's advisory states that successful attacks can result in unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. Integrity and availability of the target are not directly affected, but exposed authentication artifacts can be reused to pivot across federated applications.

The Exploit Prediction Scoring System rates the near-term exploitation probability at 0.398% as of 2026-10-22. No public proof-of-concept has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Root Cause

Oracle has not disclosed the underlying defect class in its public advisory. The vector characteristics indicate that the Authentication Engine returns or exposes protected data in response to a crafted unauthenticated HTTP request, consistent with a missing authorization or information disclosure weakness in a request handler.

Attack Vector

The attack is remote over HTTP against the Oracle Access Manager Authentication Engine endpoint. The attacker needs only network reachability to the OAM server. Because OAM is often exposed to intranets and sometimes to the internet to support SSO flows, exposure surface tends to be broad in enterprise deployments.

No verified exploit code has been released. Refer to the Oracle Critical Patch Update - October 2026 for vendor-published technical details.

Detection Methods for CVE-2026-87296

Indicators of Compromise

Unauthenticated HTTP requests to Oracle Access Manager Authentication Engine endpoints originating from unexpected source addresses.
Anomalous volumes of responses containing authentication artifacts, user attributes, or session identifiers from OAM servers.
Access patterns that bypass normal SSO redirect flows, such as direct calls to internal OAM URIs without a prior login redirect.

Detection Strategies

Enable verbose access logging on the OAM managed servers and the fronting web tier, and alert on unauthenticated requests that return HTTP 200 with response bodies larger than baseline for Authentication Engine URIs.
Correlate OAM access logs with WAF telemetry to identify request paths and parameters that do not match legitimate OAM client traffic.
Hunt in SIEM data for repeated requests to OAM endpoints without a corresponding authenticated session identifier in subsequent events.

Monitoring Recommendations

Baseline normal OAM Authentication Engine request paths, user agents, and source networks, then alert on deviations.
Monitor for outbound data flows from OAM servers to unexpected destinations following inbound unauthenticated requests.
Track Oracle Fusion Middleware patch inventory to confirm the October 2026 CPU is applied on every OAM node.

How to Mitigate CVE-2026-87296

Immediate Actions Required

Apply the Oracle October 2026 Critical Patch Update to all Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 deployments.
Inventory all internet- and partner-reachable OAM endpoints and restrict access to known client networks until patching completes.
Rotate any credentials, tokens, or secrets that could have been exposed if an OAM instance was reachable to untrusted networks prior to patching.

Patch Information

Oracle published the fix in the October 2026 Critical Patch Update. Patch availability, prerequisite bundles, and installation steps are documented in the Oracle Critical Patch Update Advisory - October 2026. Administrators should follow Oracle's recommended OPatch procedure for Fusion Middleware and validate the OAM runtime after patching.

Workarounds

Place a web application firewall or reverse proxy in front of OAM and block direct unauthenticated access to Authentication Engine URIs that are not required for public SSO flows.
Restrict network reachability of OAM administrative and internal endpoints to trusted management subnets using network ACLs or firewall rules.
Where feasible, require mutual TLS or client certificate authentication at the fronting proxy for sensitive OAM endpoints until the patch is applied.

bash

# Example: restrict access to OAM Authentication Engine URIs at an NGINX reverse proxy
location /oam/server/auth {
    allow 10.0.0.0/8;        # internal corporate network
    allow 192.168.100.0/24;  # SSO integration subnet
    deny all;
    proxy_pass https://oam-backend.internal;
}