CVE-2026-87251 Oracle Corporation CVE debrief

Who should care

Oracle Access Manager administrators and security teams should assess exposure and prioritize remediation due to the critical nature of this vulnerability. Security teams responsible for vulnerability management, network access control, and incident response should also be aware of this vulnerability. Additionally, operators and platform administrators for Oracle Access Manager deployments should review the CVE and NVD records for specific guidance on rem-

Why it matters

CVE-2026-87251 is a critical vulnerability in Oracle Access Manager that allows unauthenticated attackers to compromise the system. Oracle Access Manager administrators and security teams should assess exposure and prioritize remediation.

• Potential takeover of Oracle Access Manager
• Unauthenticated network access via SAML
• High CVSS score of 9.8 indicates critical vulnerability

Technical summary

Vulnerability in Oracle Access Manager's Authentication Engine component allows unauthenticated attacker with network access via SAML to compromise the system. The CVSS 3.1 Base Score is 9.8, indicating a critical vulnerability with high impacts on Confidentiality, Integrity, and Availability. Affected versions are 12.2.1.4.0 and 14.1.2.1.0. Successful attacks can result in takeover of Oracle Access Manager. Supplied records do not provide details on mitigations, workarounds, or specific exploitation attempts beyond the CVSS information.

Defensive priority

High priority for Oracle Access Manager administrators

Recommended defensive actions

• Review and apply Oracle's security patch for CVE-2026-87251
• Verify affected versions of Oracle Access Manager and upgrade if necessary
• Monitor network access to Oracle Access Manager for potential unauthorized activity
• Confirm whether affected product deployments exist in managed environments
• Review compensating controls for exposed systems while remediation is scheduled
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions and retest remediated assets

Evidence notes

Official CVE Program and NVD records confirm vulnerability in Oracle Access Manager. The CVE was published on 2026-10-20T21:23:50.337Z. Supplied records indicate a high CVSS score of 9.8, suggesting a critical vulnerability. However, specific details about affected deployments, additional vendor guidance, and confirmed exploitation are not provided in the records.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.