A critical vulnerability in the Authentication Engine of Oracle Access Manager lets an unauthenticated attacker with network access over HTTP compromise the product, with possible impact on other products as well.
What Is It
CVE-2026-87337 is a vulnerability in the Authentication Engine component of Oracle Access Manager, which is part of Oracle Fusion Middleware. Oracle calls it "easily exploitable." An attacker needs only network access over HTTP to compromise Oracle Access Manager. No authentication or user interaction is required.
Oracle scored it CVSS 3.1 10.0 (CRITICAL) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. That means:
- Attack vector: Network
- Attack complexity: Low
- Privileges required: None
- User interaction: None
- Scope: Changed
- Confidentiality / Integrity / Availability: High / High / None
Why It Matters
If an attack succeeds, the attacker can create, delete or modify critical data or all data that Oracle Access Manager can reach. They can also read critical data or get complete access to all of that data. Oracle says that although the flaw is in Oracle Access Manager, attacks "may significantly impact additional products," which is why the scope is rated as changed.
Oracle Access Manager handles authentication, so a compromise there can affect the applications that rely on it. The combination of no authentication, low complexity and network access makes this a high-priority fix for any organization that exposes the product.
The supplied CISA Known Exploited Vulnerabilities (KEV) entry is empty. That means KEV does not currently confirm active exploitation, and no CISA required action or due date is listed.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Access Manager (Oracle Fusion Middleware)
- Component: Authentication Engine
- Affected supported versions:
- 12.2.1.4.0
- 14.1.2.1.0
The National Vulnerability Database (NVD) record was published on 2026-10-20. Its status is "Received," so NVD analysis is still pending.
Patch Status
Oracle's October 2026 Critical Patch Update is the vendor reference for this CVE. Administrators running affected versions should review that advisory and apply the fix it describes as soon as possible. The supplied data does not give fixed version numbers. Because the scope is rated as changed, teams should also check which products and applications depend on Oracle Access Manager for authentication.