Oracle Access Manager CVE-2026-87251

Exploitation requires network reachability to the Oracle Access Manager SAML authentication interface (the Authentication Engine component) on an affected build (12.2.1.4.0 or 14.1.2.1.0); the attack is delivered via SAML, so the SAML authentication flow must be exposed/enabled on the target. Per the CVSS vector (PR:N/UI:N/AC:L) no credentials, no user interaction, and no non-default complexity conditions are stated by Oracle - it is described as easily exploitable by an unauthenticated remote attacker. The practical limiting factors are therefore network exposure of the OAM SAML endpoint (instances restricted to internal/trusted networks are harder to reach) and whether the deployment is on one of the two named affected versions; no special feature-flag or configuration prerequisite is called out in the description.

All available signals point to this being a genuine top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) describes a network-reachable, low-complexity, unauthenticated flaw with full confidentiality, integrity and availability impact, and Oracle's own description ('easily exploitable', 'unauthenticated attacker with network access via SAML', 'takeover') is fully consistent with that vector - there is no network-vs-local or auth contradiction between the text and the metrics. The critical caveat is that the richer exploitation-maturity signals are absent: no EPSS score, no POC flag, and no CISA KEV listing were supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. No SSVC decision data was provided either. The result is a classic 'high-severity, maturity-unknown' profile: the pre-conditions for mass exploitation (network, no auth, no user interaction, authentication-infrastructure target) are all present, so this should be treated as high priority and patched urgently, but claims of in-the-wild exploitation are not currently supported by the data. Because Oracle Access Manager is the SSO/identity gatekeeper in front of other applications, a compromise has outsized blast radius even without an exploit in circulation yet.

An unauthenticated attacker with network access to the Oracle Access Manager SAML endpoint sends a crafted SAML message to the Authentication Engine, abusing the flaw to bypass authentication and gain full control of the OAM instance. This yields takeover of the identity/SSO tier, letting the attacker mint or forge sessions for downstream protected applications. No public proof-of-concept was identified at time of analysis, and no user interaction or prior credentials are required.