CVE-2026-87337: Oracle Access Manager Auth Bypass Flaw

CVE-2026-87337 Overview

CVE-2026-87337 is an authentication bypass vulnerability in the Oracle Access Manager Authentication Engine component of Oracle Fusion Middleware. An unauthenticated attacker with network access via HTTP can compromise Oracle Access Manager without user interaction. The flaw carries a maximum CVSS 3.1 base score of 10.0 due to the scope change: exploitation in Oracle Access Manager impacts additional downstream products that rely on it for authentication. Successful attacks grant unauthorized creation, deletion, or modification of critical data, and complete read access to all Oracle Access Manager accessible data.

Critical Impact
Unauthenticated remote attackers can compromise Oracle Access Manager and pivot to any product that relies on it for single sign-on and access control.

Affected Products

Oracle Access Manager 12.2.1.4.0
Oracle Access Manager 14.1.2.1.0
Oracle Fusion Middleware deployments integrated with Oracle Access Manager for SSO

Discovery Timeline

2026-10-20 - CVE CVE-2026-87337 published to the National Vulnerability Database
2026-10-21 - Last updated in NVD database
October 2026 - Addressed in the Oracle Security Alert October 2026

Technical Details for CVE-2026-87337

Vulnerability Analysis

The vulnerability resides in the Authentication Engine component of Oracle Access Manager (OAM), the central identity and access management service for Oracle Fusion Middleware. OAM brokers authentication and single sign-on (SSO) for a broad set of enterprise applications. A flaw in how the Authentication Engine processes HTTP requests allows an unauthenticated attacker to bypass identity checks and obtain full read and write access to data managed by OAM.

Because the vulnerability has a changed scope, successful exploitation does not stop at OAM. Any downstream application that trusts OAM for authentication inherits the compromise. Attackers can forge or manipulate authenticated sessions for protected resources across the Fusion Middleware estate.

Root Cause

Oracle's advisory does not disclose the implementation defect. Based on the component and CVSS vector, the root cause is an authentication bypass in the HTTP request handling path of the Authentication Engine. The vulnerability is network-reachable, requires no privileges, and no user interaction. See the Oracle Security Alert October 2026 for vendor-supplied detail.

Attack Vector

Exploitation requires only HTTP access to the OAM endpoint. An attacker sends a crafted request to the Authentication Engine and receives authenticated access without presenting valid credentials. Because OAM is typically internet-facing to support federated SSO, the attack surface is often reachable from untrusted networks.

No public proof-of-concept has been published at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Oracle Access Manager has historically been a high-value target, so defenders should expect exploit tooling to appear shortly after technical details become public. Refer to the Oracle Security Alert October 2026 for exploitation guidance.

Detection Methods for CVE-2026-87337

Indicators of Compromise

Unexpected successful authentication events in OAM audit logs for accounts without a corresponding credential submission
HTTP requests to OAM endpoints such as /oam/server/ or /oamsso/ from unusual source IPs or user agents
New or modified OAM policies, resources, or user attributes created outside of change-control windows
Session tokens issued to downstream Fusion Middleware applications that do not map to a prior authentication event

Detection Strategies

Baseline normal authentication request patterns to the OAM Authentication Engine and alert on protocol anomalies or malformed HTTP requests
Correlate OAM-issued session tokens with upstream authentication events to catch sessions created without a login
Monitor administrative API calls to OAM for creation, deletion, or modification of policies and identity stores

Monitoring Recommendations

Forward OAM access, audit, and diagnostic logs to a centralized SIEM for retention and correlation
Alert on authentication activity targeting OAM from source IPs outside expected federation partners
Review downstream Fusion Middleware application access logs for sessions tied to anomalous OAM activity

How to Mitigate CVE-2026-87337

Immediate Actions Required

Apply the patches from the Oracle Security Alert October 2026 to all affected Oracle Access Manager deployments
Inventory every Oracle Access Manager instance, including non-production and disaster-recovery environments, and confirm patch status
Restrict network access to OAM administrative and authentication endpoints to known trusted sources until patching completes
Rotate OAM administrative credentials and audit recent policy and user changes for signs of tampering

Patch Information

Oracle addressed CVE-2026-87337 in the October 2026 Critical Patch Update cycle. Patches are available for Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0. Review the Oracle Security Alert October 2026 for the specific patch bundle numbers and installation prerequisites for each supported release.

Workarounds

Place OAM behind a web application firewall and block malformed or unexpected request patterns to the Authentication Engine
Limit exposure of OAM endpoints to the public internet; require VPN or zero-trust access for administrative paths
Enforce defense-in-depth authentication at downstream applications so a single OAM bypass does not grant full access

bash

# Example: restrict access to OAM admin endpoints at the reverse proxy
# (Apache httpd configuration fragment)
<Location "/oam/admin">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>
<Location "/oamconsole">
    Require ip 10.0.0.0/8
</Location>