CVE-2026-87337: Oracle Access Manager authentication bypass allows unauthenticated compromise
Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 contain an easily exploitable vulnerability in the Authentication Engine component that allows unauthenticated network attackers to gain full control. This is a CVSS 10.0 flaw with scope change affecting the entire platform.
The Authentication Engine in Oracle Access Manager fails to properly validate requests, allowing an unauthenticated attacker to bypass authentication entirely via HTTP. Successful exploitation grants unauthorized access to create, delete, or modify all data protected by Access Manager, and compromises any downstream systems that rely on Access Manager for identity and access control.
| CVE | CVE-2026-87337 |
|---|---|
| Severity | Critical (CVSS 10) |
| Actively exploited | Not confirmed at time of writing |
| Attack vector | Network |
| Privileges required | None |
| User interaction | None |
| Published | 20 Oct 2026 |
How the attack works
The vulnerability stems from improper validation of authentication credentials or session tokens in the Authentication Engine component. An attacker without valid credentials can craft a malformed or missing authentication header in an HTTP request to Access Manager. The server fails to enforce authentication requirements and processes the request as if it came from a trusted, authenticated user. This allows the attacker to perform any action (read, write, delete) that an authenticated user could perform.
Who is affected
Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 are affected. Any deployment running these specific versions is at immediate risk.
How to check if you're exposed
- Identify all Oracle Access Manager deployments and verify their exact version (Admin Console > About)
- Check if version is 12.2.1.4.0 or 14.1.2.1.0; either match indicates exposure
- Review HTTP access logs to Access Manager for requests with missing or malformed authentication headers originating from unexpected sources
- Monitor Access Manager audit logs for successful authentications from unknown or suspicious IP addresses
How to fix it
- Apply Oracle's security patch immediately for versions 12.2.1.4.0 and 14.1.2.1.0
- Upgrade to a newer patched version of Oracle Access Manager if available
- After patching, audit the Access Manager audit log for any unauthorized modifications or access during the exposure window
If you can't patch yet
- Restrict network access to Oracle Access Manager ports (typically 7001, 7002, etc.) to trusted administrators and internal systems only; block internet-facing exposure immediately
- Enable strict HTTP request validation and rate-limiting on Access Manager endpoints
- Monitor all authentication attempts and API calls to Access Manager in real time; alert on any successful authentications without valid credentials
Need help checking your exposure or patching at scale? FutureOps InfoTech can help.