CVE-2026-87337 Oracle Corporation CVE debrief

Who should care

Oracle Access Manager administrators, security teams, and IT professionals responsible for patch management and vulnerability remediation should assess exposure and take immediate action to prevent exploitation.

Why it matters

CVE-2026-87337 is a critical vulnerability in Oracle Access Manager that allows unauthenticated attackers to compromise the product and access sensitive data. Oracle Access Manager administrators and security teams should assess exposure and take immediate action to prevent exploitation.

• Potential unauthorized creation, deletion, or modification access to critical data or all Oracle Access Manager accessible data
• Potential unauthorized access to critical data or complete access to all Oracle Access Manager accessible data
• Possible scope change impacting additional products
• Need for immediate patching or mitigation to prevent exploitation

Technical summary

The vulnerability is in the Authentication Engine component of Oracle Access Manager, allowing unauthenticated attackers with network access via HTTP to compromise the product. CVSS 3.1 Base Score is 10.0 with Confidentiality and Integrity impacts. The vulnerability affects versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Access Manager. To address this vulnerability, it is crucial to assess exposure and apply patches or mitigations to prevent unauthorized access and data tampering. Oracle Access Manager administrators and security teams should verify the scope of impact and identify additional products that may be affected.

Defensive priority

Immediately assess exposure and apply patches or mitigations to prevent unauthorized access and data tampering.

Recommended defensive actions

• Assess exposure of Oracle Access Manager instances to the internet and restrict access if necessary
• Apply patches or updates provided by Oracle to vulnerable versions (12.2.1.4.0 and 14.1.2.1.0)
• Monitor for suspicious activity and implement compensating controls to detect potential attacks
• Verify scope of impact and identify additional products that may be affected
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its critical severity and potential impact on Oracle Access Manager. However, additional information on affected versions, exploitation, and remediation may require verification from official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.