Description

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Agent infrastructure). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SAML to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-18T21:17:48.283Z",
  "pubdate": "2026-08-18T21:17:48.283Z",
  "executiveSummary": "A critical security vulnerability exists within the Oracle Access Manager product of Oracle Fusion Middleware, specifically affecting the Agent infrastructure component. This flaw exposes the application to remote, unauthenticated exploitation by malicious actors over a network via the SAML protocol.\nSuccessful exploitation of this vulnerability grants an unauthorized attacker complete control over the affected Oracle Access Manager deployment, resulting in a total system takeover. The severity of this issue is reflected in its maximum CVSS 3.1 base score of 9.8, indicating catastrophic impacts across all triad dimensions: Confidentiality, Integrity, and Availability.\nThe supported product versions confirmed to be vulnerable are 12.2.1.4.0 and 14.1.2.1.0. The attack vector is strictly network-based, requiring zero privileges and no user interaction, making it exceptionally dangerous. The combination of unauthenticated access, network exposure, and complete system compromise necessitates immediate remediation and defensive intervention to prevent unauthorized access and systemic operational disruption.",
  "technicalDetails": "The vulnerability resides in the Agent infrastructure component of Oracle Access Manager, specifically impacting versions 12.2.1.4.0 and 14.1.2.1.0. The root cause stems from improper validation and processing of input data received via the SAML protocol, allowing malicious payloads to bypass authentication and authorization checks implemented within the framework.\nExploitation is classified under a network attack vector (AV:N) with low attack complexity (AC:L), requiring neither prior authentication (PR:N) nor user interaction (UI:N). An unauthenticated remote attacker can craft specialized SAML requests or assertions designed to exploit the parsing logic or state validation mechanisms within the vulnerable Agent infrastructure.\nThe attack flow proceeds as follows: First, the attacker identifies a publicly accessible endpoint exposed by the Oracle Access Manager deployment that handles SAML communications. Second, the attacker transmits a maliciously crafted SAML payload over the network. Third, due to the flaw in the Agent infrastructure component, the application improperly processes the untrusted input without enforcing mandatory authentication constraints.\nThis failure in input verification or session handling permits the attacker to inject arbitrary commands, manipulate internal execution states, or elevate privileges remotely. Consequently, the payload behavior facilitates total administrative control, leading to the complete takeover of the Oracle Access Manager instance.\nThe post-exploitation impact is severe, encompassing full confidentiality, integrity, and availability (C:H/I:H/A:H) breaches. Once the Oracle Access Manager system is compromised, the attacker gains the ability to intercept, forge, or manipulate single sign-on (SSO) credentials, access sensitive enterprise directory data, pivot to interconnected backend systems, and completely disrupt authentication services across the enterprise infrastructure."
}