Zero Radar
← feed
CriticalVulnerabilityCVE-2026-87337updated 25 Oct 2026, 18:35 UTC

Oracle Access Manager flaw lets unauthenticated attackers take over login system

Oracle Access Manager is software that controls who can log in to company systems. A flaw in its login engine can let an attacker over the network, without any password, read and change data it manages, and possibly reach other connected pr

Official, 2 sources
SeverityCriticalCVSS 10 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Remote attackerNo login or password needed
  2. 2HTTP requestSent to the Oracle Access Manager endpoint
  3. 3Authentication EngineFlaw bypasses the login check
  4. 4Critical dataRead, changed, or deleted
  5. ResultAttacker gains broad control of the system

What happened

An unauthenticated network-reachable flaw in the Authentication Engine component of Oracle Access Manager (Oracle Fusion Middleware) allows full compromise of confidentiality and integrity, with scope change affecting other products.

Why it is dangerous: An attacker needs no credentials and can create, modify or delete critical data or gain complete access to everything Oracle Access Manager holds, and can spread to other systems. Organizations using it for single sign-on are at high risk.

Are you affected?

You are affected if you run Oracle Access Manager 12.2.1.4.0 or 14.1.2.1.0 with its HTTP interface reachable from the network.

Oracle Access Manager 12.2.1.4.0; Oracle Access Manager 14.1.2.1.0 (Oracle Fusion Middleware, Authentication Engine component)

What to do

  1. Check whether Oracle Access Manager 12.2.1.4.0 or 14.1.2.1.0 is installed
  2. Apply the official Oracle Critical Patch Update or fix for this advisory as soon as it is available
  3. Restrict network access to the Oracle Access Manager HTTP interface until patched
  4. Review logs for unusual unauthenticated requests to the authentication endpoints

Timeline

  1. 20 Oct 2026, 22:20 UTC
    Publicly disclosed
  2. 20 Oct 2026, 22:20 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 18:35 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-87337 · GHSA-m5hf-f8cr-8px8
CVSS
10 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
20 Oct 2026, 22:20 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 18:35 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Oracle Access Manager flaw lets unauthenticated attackers take over login system · Zero Radar