EUVD-2026-61854
GHSA-hv69-9965-h4cf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable SAML endpoint exploitable by an unauthenticated attacker with no interaction, and 'takeover' implies full confidentiality, integrity, and availability loss.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Agent infrastructure). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SAML to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
SAML-based authentication bypass and full product takeover affects Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 within Oracle Fusion Middleware's Agent infrastructure component. A remote attacker with no credentials can reach the SAML processing surface over the network and, per Oracle's own rating, easily compromise the identity broker outright - CVSS 9.8 with full confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target Oracle Access Manager instance (12.2.1.4.0 or 14.1.2.1.0) exposes its SAML-processing Agent infrastructure endpoint to the attacker over the network - the description explicitly names 'network access via SAML' as the vector, so a deployment with SAML federation/agent handling reachable by the attacker is the concrete prerequisite. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority issue, not a high-CVSS-but-low-real-risk case. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fixes delivered in the Oracle Critical Patch Update of August 2026 - Patch available per vendor advisory (https://www.oracle.com/security-alerts/cspuaug2026.html); the input provides no discrete patched build number beyond the CPU bundle, so obtain the exact OAM patch for your 12.2.1.4.0 or 14.1.2.1.0 line directly from that advisory and My Oracle Support. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 instances, map their protected applications, and implement network segmentation to restrict SAML endpoint access to authorized federation partners only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Access Manager
View allVulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Ra
There is a time-based blind SQL injection vulnerability in the Access Manager component before 9.18.040 and 10.x before
Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Authentication Engine).
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/
Cross-site request forgery (CSRF) vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Acce
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allow remote atta
Remote unauthenticated compromise of Oracle Access Manager (Fusion Middleware Authentication Engine) in supported versio
iManager Admin Console in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to iFrame
Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.1 allow remote attackers
Privilege escalation to full takeover in Oracle Access Manager (Fusion Middleware) 12.2.1.4.0 and 14.1.2.1.0 allows a lo
Full compromise of Oracle Access Manager is possible when an unauthenticated attacker sends crafted HTTP requests to the
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today