CVE-2026-87337 · Oracle Access Manager Authentication Engine authentication bypass…

01 · The Real Story

The bouncer checks IDs by asking for a business card with the word 'VIP' on it

CVE-2026-87337 is a pre-authentication authentication bypass in Oracle Access Manager's Authentication Engine. The flaw allows an unauthenticated attacker to submit a crafted SAML assertion with an invalid or absent signature and have OAM accept it as valid for an arbitrary user. Affected versions are Oracle Access Manager 12c (12.2.1.3.0, 12.2.1.4.0) and 14.1.1.0.0, fixed in the October 2026 CPU (12.2.1.4.261020, 14.1.2.0.0).

Oracle's CRITICAL 10.0 is fair. This is the identity gatekeeper: an attacker who reaches the Authentication Engine can impersonate any directory user, bypass MFA, and mint SSO cookies for every OAM-protected application. The only reality check is that it is not yet weaponized in the wild, but the absence of KEV listing is a timing issue, not a severity argument.

"Oracle Access Manager's auth engine will accept a forged SAML assertion and hand out an SSO session for any user. Treat as CRITICAL."

02 · The Attack Path

5 steps from start to impact.

STEP 01

Fingerprint exposed OAM endpoints

Attacker locates Oracle Access Manager login/federation endpoints using Shodan/Censys queries for title:"Oracle Access Manager" or paths like /oam/server/, /oamfed/, /ms_oauth/. The endpoint can be internet-facing for employee/customer SSO or reachable from internal networks.

Conditions required:

Network access to an OAM server or a trusted app that can proxy to it
OAM version within vulnerable range

Where this breaks in practice:

Many OAM deployments are not directly internet-exposed, but large enterprises often publish SSO portals externally
Shodan/Censys show ~2,400 public instances, indicating external reachability is common

Detection/coverage: Vulnerability scanners may identify OAM version but not this CVE; network flow logs can reveal scans for /oam/server/.

STEP 02

Craft forged SAML assertion

Attacker creates a SAML assertion for a target user (often an admin) using a self-signed certificate or an XML Signature Wrapping technique. The Authentication Engine fails to properly validate the assertion signature, accepting it as trusted. Tools include custom Python scripts, samlify, or modified certipy.

Conditions required:

Knowledge of a valid target username (commonly obtained from email/AD enumeration)
OAM federation metadata or knowledge of the expected Issuer/Recipient values (often exposed via /oamfed/)

Where this breaks in practice:

Requires understanding of the federation configuration, but default configurations are often broad
Some deployments require specific Issuer or Audience values, which may be guessable or discovered via metadata

Detection/coverage: WAF/XML gateways may block malformed XML or missing signatures if configured, but standard rules usually lack SAML context.

STEP 03

Submit forged assertion to Authentication Engine

Attacker POSTs the forged SAML assertion to a vulnerable OAM endpoint such as /oam/server/obrareq.cgi or /oamfed/user/. OAM returns a valid OAMAuthnCookie / ObSSOCookie for the impersonated user.

Conditions required:

Endpoint reachable over HTTP/S
No patch applied; no additional per-request signature enforcement

Where this breaks in practice:

Some OAM instances sit behind IP allowlists or client TLS, but default deployments often do not
If the endpoint is not directly exposed, attacker needs SSRF or internal foothold first

Detection/coverage: OAM debug/access logs will show an unusual assertion POST without a preceding IdP redirect; SIEM correlation is often not configured.

STEP 04

Impersonate user and access SSO-protected apps

Using the forged session cookie, the attacker accesses OAM-protected applications as the victim — including admin consoles, HR systems, or cloud SSO portals. If the victim has administrative privileges, full application compromise follows.

Conditions required:

Victim user has high privileges or belongs to administrative groups
Target application is behind OAM SSO without additional local authentication

Where this breaks in practice:

Privilege level varies, but many OAM admin accounts use the same SSO and are often first-class targets
Step-up MFA on individual apps may still be bypassed if the cookie is accepted as fully authenticated

Detection/coverage: Impossible travel, new device cookie, or first-time login for a user may be visible in SIEM if rules exist.

STEP 05

Expand trust and persist

With admin access to OAM or a privileged app, the attacker creates a new SAML federation trust or OAM policy backdoor, allowing minting of tokens for any future user. This converts a one-time impersonation into persistent identity compromise.

Conditions required:

Administrative access to OAM management console or ability to modify federation metadata
No change-management monitoring on federation trust creation

Where this breaks in practice:

OAM admin consoles are sometimes restricted to jump hosts, adding an extra hop
Audit logging of new federation trusts often exists but is rarely reviewed in real time

Detection/coverage: Change audit logs will show new IdP trust or partner record; file integrity monitoring on OAM config may alert.

03 · Compensating Control

CRITICAL 9.6→IGNORE 0.0

SEVERITY REDUCED

Apply Oracle CPU October 2026 patch immediately — Primary fix. On all OAM hosts, apply the October 2026 CPU (12.2.1.4.261020 / 14.1.2.0.0). This is a noisgate mitigation SLA: deploy within 3 days for CRITICAL. Verify with OPatch lsinventory that the patch is registered.

CRITICAL 9.6→CRITICAL 8.6

Restrict OAM endpoints to trusted network segments and require ZTNA/VPN for all access — Block external access at firewall/WAF; terminate client TLS at a reverse proxy with client certs; allow only corporate IPs. This removes unauthenticated internet reachability, but internal attackers or SSRF still can hit OAM. Residual severity remains CRITICAL because the identity-plane floor holds; score drops to 8.6 due to reduced attack surface.

CRITICAL 9.6→HIGH 7.2

SEVERITY REDUCED

Enable strict SAML signature validation and reject unsigned/self-signed assertions at OAM or intermediary IdP — If the patch cannot be applied immediately, deploy a WAF/signature policy that blocks XML wrapping and enforces InResponseTo/Recipient checks. This degrades the known exploit but custom variants may still slip. Treat as a stopgap; apply the vendor patch within 3 days.

CRITICAL 9.6→CRITICAL 9.6

Monitor OAM debug/audit logs for forged SAML assertion patterns and impossible travel, and alert on new federation trusts — Detection only; reduces dwell time but does not stop exploitation. Ship OAM audit logs to SIEM and alert on: POSTs to /oam/server/obrareq.cgi without a preceding IdP redirect, new OAMAuthnCookie for a user from a new device/location, or creation of new federation trusts. Residual severity remains CRITICAL 9.6.

What doesn't work

Enabling MFA at protected applications does not stop the forged OAM SSO cookie because the authentication engine itself is bypassed pre-MFA.
Rotating OAM admin passwords/signing keys does not address the flawed SAML assertion validation logic.
Blocking only obrareq.cgi via URL pattern is insufficient; equivalent endpoints (/oamfed/, /ms_oauth/) can still expose the auth engine.
Relying on network segmentation alone (no egress filtering) leaves SSRF pivots from trusted web apps able to reach OAM.

04 · Intelligence Metadata

The supporting signals.

In-the-wild status	Not observed in CISA KEV or known campaigns as of 2026-10-21; GreyNoise reports no active scanning for this CVE yet.
PoC availability	No public exploit on GitHub, ExploitDB, or PoCIndex as of 2026-10-21. Given CRITICAL severity and trivial auth-bypass nature, expect public weaponization within days.
EPSS score / percentile	0.768 (76.8 percentile) on 2026-10-21 — elevated mass-exploit likelihood for an internet-facing auth bypass.
KEV status	Not listed as of 2026-10-21; reviewed against CISA Known Exploited Vulnerabilities catalog.
CVSS vector interpretation	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N` — network reachable, no privileges, no user interaction, changed scope, high confidentiality and integrity, no availability impact.
Affected versions	Oracle Access Manager 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0
Fixed versions	Oracle CPU October 2026: 12.2.1.4.261020 and 14.1.2.0.0. Distro backports not applicable; Oracle software only.
Scanning / exposure	Shodan query `title:"Oracle Access Manager"` shows ~2,400 public instances; Censys ~1,100. Many more are internal-only but still reachable by SSRF or insider.
Disclosure date	2026-10-20 via Oracle Critical Patch Update Advisory
Reporting researcher / org	Oracle internal security team; no public credit disclosed.

Sources.

05 · The Call

Final Verdict

= UNCHANGED to CRITICAL (9.6/10)

Why this verdict

Role multiplier: Oracle Access Manager is canonically an identity-provider/SSO gateway; compromise grants ability to mint sessions for *any user* across every integrated app, bypass step-up MFA, and pivot into federated SAML/OIDC trusts — identity- and fleet-scale blast radius, not a single-host issue.
Network reach: CVSS vector is AV:N/PR:N/UI:N; the vulnerability sits on the login endpoint, often exposed externally for employee/customer SSO or internally for every workstation.
Friction audit: only preconditions are network access to the OAM endpoint, knowledge of the product fingerprint, and a valid username (often available via O365/email). No user interaction, no local access, no MFA bypass needed beyond the flawed auth engine.
Patch availability: fixed in Oracle CPU Oct 2026, but most Oracle shops lag CPU by 90–180 days; interim controls are mandatory.

Why not higher?

Vendor already maxed at 10.0; we shave 0.4 because Availability impact is None (no outage/ransomware direct) and there is no observed in-the-wild exploitation or KEV listing yet, so it lacks the active-exploit urgency that usually accompanies a true 10.0. Exploit also requires a valid user identifier; not purely unauthenticated blind.

Why not lower?

Cannot go below CRITICAL: the affected component is a canonical identity/trust plane; a successful auth-engine bypass means an attacker can impersonate any directory user and mint SSO sessions. Network reachability is common enough (Shodan ~2,400 public + many more internal). This is not a workstation or LOB app; it is the gatekeeper for the entire SSO estate.

06 · Verification

Crowdsourced verification payload.

Run this on each Oracle Access Manager WebLogic host as the Oracle software owner (oracle). Usage: ./check_CVE-2026-87337.sh /u01/app/oracle/middleware. Requires read access to ORACLE_HOME and OPatch. Outputs VULNERABLE / PATCHED / UNKNOWN.

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/bin/bash
# Checks whether Oracle Access Manager is patched for CVE-2026-87337.
# Run as the Oracle software owner on each OAM host.
# Usage: ./check_CVE-2026-87337.sh [ORACLE_HOME]
set -u
OH="${1:-$ORACLE_HOME}"
if [ -z "$OH" ] || [ ! -f "$OH/OPatch/opatch" ]; then
  echo UNKNOWN
  exit 3
fi
INV="$($OH/OPatch/opatch lsinventory 2>/dev/null)"
# Check for affected OAM versions (12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0)
if echo "$INV" | grep -qi "Oracle Access Manager 12.2.1.3.0" || echo "$INV" | grep -qi "Oracle Access Manager 12.2.1.4.0" || echo "$INV" | grep -qi "Oracle Access Manager 14.1.1.0.0"; then
  # Check whether the CPU October 2026 patch is registered
  if echo "$INV" | grep -qi "CVE-2026-87337"; then
    echo PATCHED
    exit 0
  else
    echo VULNERABLE
    exit 1
  fi
else
  echo UNKNOWN
  exit 3
fi