CVE-2026-87337

CRITICAL

Summary

generated automatically from NVD data

CVE-2026-87337 affects the Authentication Engine component of Oracle Access Manager in Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access over HTTP can easily exploit it, and a successful attack could allow unauthorized access to, and creation, modification or deletion of, all data Oracle Access Manager can reach. The scope change means other products may also be significantly affected. It is rated CRITICAL with a CVSS 3.1 score of 10.0.

NVD description

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Access Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 10.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).

EPSS · FIRST.org

0.43%probability of exploitation in the next 30 days

Higher than 35% of scored CVEs

EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-21, recomputed daily by FIRST.org.

In-depth analysis on cveo.tech

We've published a detailed analysis of this CVE — exploitation, IOCs and mitigation.