CVE-2026-87251 is a critical (CVSS 9.8) flaw in the Authentication Engine of Oracle Access Manager that lets an unauthenticated attacker with network access take over the product via SAML.
What Is It
CVE-2026-87251 is a vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware, in the Authentication Engine component. Oracle describes it as "easily exploitable." An unauthenticated attacker with network access can exploit it via SAML to compromise Oracle Access Manager.
Oracle ([email protected]) assigned it a CVSS 3.1 base score of 9.8 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. That breaks down as:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Confidentiality / Integrity / Availability impact: High / High / High
NVD published the record on 2026-10-20. Its status is "Received," so NVD has not yet completed its own analysis.
Why It Matters
Oracle Access Manager handles authentication and access control. According to Oracle, a successful attack can result in takeover of Oracle Access Manager, with high impact to confidentiality, integrity and availability. The attacker needs no credentials and no user interaction, and the attack complexity is low. Any instance that accepts SAML traffic from an untrusted network should be treated as high priority.
Exploitation status: CVE-2026-87251 is not in the CISA Known Exploited Vulnerabilities (KEV) catalog, and the supplied data does not confirm active exploitation. There is also no CISA-mandated remediation deadline. Check the KEV catalog again, since that status can change.
What's Vulnerable
The vendor is Oracle Corporation. The affected product is Oracle Access Manager (Oracle Fusion Middleware), Authentication Engine component.
Oracle lists these supported versions as affected: - 12.2.1.4.0 - 14.1.2.1.0
NVD has not yet published CPE configuration data for this CVE.
Patch Status
The NVD record's only reference is Oracle's Critical Patch Update Advisory – October 2026. Administrators running the affected versions should read that advisory for fix details and apply the relevant updates. Because the flaw is network-reachable, unauthenticated and rated critical, it should be near the top of the October 2026 CPU patching queue. CISA has issued no required action, because the CVE is not in KEV.
Sources
- NVD – CVE-2026-87251
- Oracle Critical Patch Update Advisory – October 2026
- CISA Known Exploited Vulnerabilities Catalog (no entry for this CVE at time of writing)