Oracle Access Manager

product · product:oracle-access-manager single-source

Coverage

first 2026-09-20 → last 2026-10-29

Latest activity

2026-10-29

Oracle's October CPU: six unauthenticated CVSS 10.0 rows, two WebLogic 9.8 flaws; EBS decoys probed on 27 Oct

Peak priority

notable

2 notable

Targets

public-sector

sectors: public-sector, finance, healthcare · regions: europe, switzerland

Sources cited

6 hosts

Action items (3)

Do-now tasks recorded on the entries about Oracle Access Manager, newest first. Check the date before acting on an older one.

Patch every E-Business Suite 12.2.3 to 12.2.15 web tier for CVE-2026-101767 now, because exploit attempts began a week after release, and review its web logs since 2026-10-27 for unauthenticated requests to the Thin Client Framework servlet and for database or Concurrent Manager activity that followed.
2026-10-21CVE-2026-87337 +11
Apply Oracle's September 2026 Critical Security Patch Update now to every affected Fusion Middleware, Hyperion Financial Management, Analytics, Enterprise Manager, Communications Unified Assurance and Product Lifecycle Analytics deployment. It is an off-quarter release that a quarterly patch calendar does not schedule.
2026-09-20CVE-2026-83021 +49
Patch Oracle E-Business Suite 12.2.3-12.2.15 for CVE-2026-83327, CVE-2026-83452 and CVE-2026-83462 in this same release now: Cl0p exploited an earlier Oracle EBS zero-day from August 2025 to steal files from many organizations, and these three flaws need no credential and no user interaction.
2026-09-20CVE-2026-83021 +49

Defender insights

What each entry about Oracle Access Manager tells a defender to do, newest first.

2026-10-21NOTABLEOracle's October CPU: six unauthenticated CVSS 10.0 rows, two WebLogic 9.8 flaws; EBS decoys probed on 27 Oct

Exposure · detection

2026-09-20NOTABLEFifty credential-free, no-interaction flaws span Oracle's middleware, ERP, BI and telco-assurance lines in an off-quarter patch release

Story timeline

2026-10-21Oracle October 2026 Critical Patch Update: six unauthenticated network CVSS 10.0 rows in Access Manager, SOA Suite, E-Business Suite and JD Edwards, and WebLogic CVSS 9.8 flaws reachable over HTTP and T3/IIOP
trending-vulnerabilitiesOracle's October CPU: six unauthenticated CVSS 10.0 rows, two WebLogic 9.8 flaws; EBS decoys probed on 27 Oct
2026-09-20Oracle's September 2026 Critical Security Patch Update carries fifty unauthenticated CVSS 9.8+ flaws, concentrated in Fusion Middleware's identity, forms, directory and portal components, plus E-Business Suite, Hyperion, Analytics, Enterprise Manager, Communications and Supply Chain products
trending-vulnerabilitiesFifty credential-free, no-interaction flaws span Oracle's middleware, ERP, BI and telco-assurance lines in an off-quarter patch release

ATT&CK techniques (2 across 2 tactics)

2 techniques observed across 2 entries about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

Initial AccessExploit Public-Facing Application
ExecutionCommand and Scripting Interpreter: Unix Shell

Initial Access TA0001

T1190Exploit Public-Facing Application×2

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-10-21/oracle-october-2026-cpu-six-unauthenticated-cvss-10-rows · 2026-09-20/oracle-september-2026-cspu-five-unauthenticated-cvss-10 · ATT&CK page ↗

Execution TA0002

T1059.004Command and Scripting Interpreter: Unix Shell×1

Adversaries may abuse Unix shell commands and scripts for execution. Unix shells are the primary command prompt on Linux, macOS, and ESXi systems, though many variations of the Unix shell exist (e.g. sh, ash, bash, zsh, etc.) depending on the specific OS or distribution. Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.

Evidence: 2026-10-21/oracle-october-2026-cpu-six-unauthenticated-cvss-10-rows · ATT&CK page ↗

Entries about Oracle Access Manager (2)

2026-10-21 · view entry permalink →

NOTABLECVE-2026-87337 +11updatedNATOA2

Oracle October 2026 Critical Patch Update: six unauthenticated network CVSS 10.0 rows in Access Manager, SOA Suite, E-Business Suite and JD Edwards, and WebLogic CVSS 9.8 flaws reachable over HTTP and T3/IIOP

Oracle's Critical Patch Update advisory of 2026-10-20 contains 1295 new security patches (Oracle, 2026-10-20). Its risk matrices score 112 rows at CVSS 3.1 9.0 or higher, and 90 of those, covering 73 distinct CVE ids, are marked as remotely exploitable without authentication with a network attack vector (Oracle, 2026-10-20). Six rows score 10.0: CVE-2026-87337 in the Access Manager Authentication Engine (HTTP), CVE-2026-91231 in the SOA Suite Adapters (HTTP), CVE-2026-91216 and CVE-2026-91221 in the SOA Suite Fabric Layer (T3 and IIOP), CVE-2026-101809 in the E-Business Suite Workflow Notification Mailer (HTTP, 12.2.3 to 12.2.15) and CVE-2026-91299 in the JD Edwards EnterpriseOne Orchestrator security component (HTTP, 9.2.0.0 to 9.2.26.5) (Oracle, 2026-10-20). WebLogic Server 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 carry CVE-2026-91323 (HTTP) and CVE-2026-83399 (T3 and IIOP) at 9.8 and CVE-2026-87302 (HTTP) at 9.1; Identity Manager's End User Self Service has CVE-2026-91408 (T3 and IIOP, 9.8) and Access Manager's SAML path CVE-2026-87251 (9.8) (Oracle, 2026-10-20). The advisory states no exploitation for any row and carries only Oracle's standing sentence that it receives reports of attempts to exploit already-patched flaws (Oracle, 2026-10-20); for CVE-2026-101767, Defused's decoys have since recorded exploit attempts, described in the update below. Oracle points to My Oracle Support documents for patch availability (Oracle, 2026-10-20).

This Critical Patch Update contains 1295 new security patches across the product families listed below.

Oracle continues to periodically receive reports of attempts to maliciously exploit vulnerabilities for which Oracle has already released security patches.

Oracle

According to Defused, the first exploitation attempts targeting CVE-2026-101767 were observed on October 27.

SecurityWeek

Improvement25 Oct 2026 14:09 UTCrun 2026-10-25T1308Z-auditcvestechniquessourcessourcing_notebody

Horizon3, which reported CVE-2026-101767 to Oracle on 2026-07-24, described the chain on release day, without publishing exploit code. An unauthenticated SQL injection in the Thin Client Framework servlet of E-Business Suite 12.2.3 to 12.2.15 (Application Object Library, Core component, CVSS 3.1 9.8), which the default EBS URL firewall configuration permits, gives SQL execution as the APPS database user and then operating-system commands as the EBS application account (Horizon3.ai, 2026-10-20). Until the update is in, Horizon3 advises removing the servlet from the URL firewall allowlist and restricting the web tier to trusted networks, measures that reduce exposure but do not replace patching (Horizon3.ai, 2026-10-20). Oracle scores the row 9.8, unauthenticated over HTTP (Oracle, 2026-10-20).

Update29 Oct 2026 04:56 UTCrun 2026-10-29T0255Z-intelheadlinesummaryupdated_atsourcesevidencesourcing_noteactionsbody

Threat-intelligence firm Defused reported that its Oracle E-Business Suite decoys recorded exploratory exploit attempts against CVE-2026-101767 on the morning of 2026-10-27, one week after the October update (SecurityWeek, 2026-10-28; BleepingComputer, 2026-10-28). BleepingComputer notes that Oracle has not tagged the flaw as exploited and that Shadowserver tracks more than 670 internet-exposed E-Business Suite instances, without saying how many are decoys or already patched (BleepingComputer, 2026-10-28). SecurityWeek adds that there have been no other reports of in-the-wild exploitation; the attempts hit decoys, and neither article describes a compromise of a production system (SecurityWeek, 2026-10-28).

vulnerability21 Oct 03:41Zsingle-sourceOpen finding →

Sources: Oracle (Critical Patch Update Advisory, October 2026) · Horizon3.ai (CVE-2026-101767 write-up) · SecurityWeek (reporting Defused) · BleepingComputer (reporting Defused)

2026-09-20 · view entry permalink →

NOTABLECVE-2026-83021 +49updatedNATOA2

Oracle's September 2026 Critical Security Patch Update carries fifty unauthenticated CVSS 9.8+ flaws, concentrated in Fusion Middleware's identity, forms, directory and portal components, plus E-Business Suite, Hyperion, Analytics, Enterprise Manager, Communications and Supply Chain products

Oracle published its September 2026 Critical Security Patch Update on 2026-09-15 (Rev 1, initial release) with 673 new security patches across its product families; Oracle Fusion Middleware alone accounts for 153 of them, and Oracle states that "78 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials" (Oracle, 2026-09-15). Six flaws in the release carry a CVSS 3.1 base score of 10.0 in Oracle's own risk matrix with Attack Vector Network, Attack Complexity Low, Privileges Required None, User Interaction None and Scope Changed, meaning an unauthenticated request across the network reaches high confidentiality and integrity impact and crosses a security boundary (the first five also reach high availability impact; Hyperion Financial Management's is rated none): CVE-2026-83021 in the Web Container of Oracle WebLogic Server over HTTP, CVE-2026-71133 in the Authentication Engine of Oracle Access Manager over HTTP, CVE-2026-83099 in Oracle Forms Services over HTTP, CVE-2026-83059 in the OID LDAP Server of Oracle Internet Directory over LDAP, CVE-2026-83020 in the centralized third-party jars of Oracle Platform Security for Java over HTTP, and CVE-2026-87230 in the Security component of Oracle Hyperion Financial Management over HTTP (Oracle, 2026-09-15). The Netherlands' national cyber-security centre relayed the release's 153 Fusion Middleware fixes as advisory NCSC-2026-0372 on 2026-09-16 and rated both likelihood and damage high (NCSC-NL, 2026-09-16).

The Critical Security Patch Update is Oracle's second, higher-frequency release line, published alongside the quarterly cumulative Critical Patch Update rather than replacing it: Oracle describes it as providing "targeted, high-priority security fixes in a smaller, more focused format, making them easier to apply with minimal disruption" and says these updates "complement Oracle’s existing quarterly cumulative Critical Patch Updates (CPUs)" (Oracle, 2026-09-15). Oracle now releases security patches on the third Tuesday of each month. Its next four dates are the Critical Patch Update of 20 October 2026, Critical Security Patch Updates on 17 November and 15 December 2026, and the Critical Patch Update of 19 January 2027 (Oracle, 2026-09-15). A patch calendar built only on the quarterly dates misses the releases in between.

Oracle discloses no exploitation technique, no proof-of-concept status and no in-the-wild activity for any of the fifty unauthenticated flaws, and no source names an exploited flaw (Oracle, 2026-09-15). What forces the timeline is the shape of the flaws: every one is reachable by an unauthenticated network request with no user interaction (Oracle, 2026-09-15). The six rated CVSS 10.0 sit in components that front other systems or hold what they rely on: WebLogic's web container, Access Manager's authentication engine, an Internet Directory LDAP listener, Forms Services, the shared Java security jars underneath Fusion Middleware, and Hyperion Financial Management's security component (Oracle, 2026-09-15). Where an organization runs its single sign-on, directory or application-server tier on these Fusion Middleware components, a Scope Changed rating on an authentication engine means the compromise does not stay inside the component that carries the flaw.

This Critical Security Patch Update contains 153 new security patches for Oracle Fusion Middleware.

78 of these vulnerabilities may be remotely exploitable without authentication, i.e., may be exploited over a network without requiring user credentials.

A Critical Security Patch Update (CSPU) provides targeted, high-priority security fixes in a smaller, more focused format, making them easier to apply with minimal disruption.

This Critical Security Patch Update contains 159 new security patches for Oracle E-Business Suite. 19 of these vulnerabilities may be remotely exploitable without authentication

Oracle 2026-09-15

Update29 Sep 2026 04:40 UTCrun 2026-09-29T0405Z-inteltitleheadlinesummaryaffected_productscvesevidencesourcing_noteactionsbody

Oracle's September 2026 risk matrix lists eight further unauthenticated CVSS 9.8 flaws (Attack Vector Network, Privileges Required None, User Interaction None) beyond the six CVSS 10.0 flaws, across four further product families (Oracle, 2026-09-15). Oracle E-Business Suite carries 159 new patches, of which 19 are remotely exploitable without authentication: "This Critical Security Patch Update contains 159 new security patches for Oracle E-Business Suite. 19 of these vulnerabilities may be remotely exploitable without authentication" (Oracle, 2026-09-15). Three of those nineteen reach CVSS 9.8 with no further precondition: CVE-2026-83327 in the Applications Framework's Personalization component over SOAP, CVE-2026-83452 in Document Management and Collaboration's Internal Operations component over HTTP, and CVE-2026-83462 in the Mobile Application Server's MWA Terminal Server component over TCP, all affecting versions 12.2.3 through 12.2.15. Oracle Business Intelligence Enterprise Edition (Oracle Analytics, 50 new patches, 8 unauthenticated) carries CVE-2026-83283 in its Platform Security component (version 12.2.1.4.0, over HTTP). Oracle Enterprise Manager carries CVE-2026-41635 (Agent Next Gen / Apache Mina component, versions 13.5/24.1, over HTTP, the same patch also fixing CVE-2026-41409 and CVE-2026-42779) and CVE-2026-83355 (Enterprise Manager for Fusion Middleware's Metrics component, same versions). Oracle Communications (31 new patches, 23 unauthenticated) carries CVE-2026-44024 (Unified Assurance's Core/Fluentd component, versions 6.1.1-7.0.0, the same patch also fixing CVE-2026-44025, CVE-2026-44160 and CVE-2026-44161) and CVE-2026-17544 (Unified Assurance's Core/PHP component, version 7.0.0).

On the same bar (Access Vector Network, Privileges Required None, User Interaction None, "Remote Exploit without Auth." Yes), the matrix lists thirty-two further CVSS 9.8 flaws inside the Fusion Middleware product line, beyond the single CVSS 10.0 flaw in each of five of its components. Access Manager carries four more (CVE-2026-73950, CVE-2026-73947, CVE-2026-73940, CVE-2026-47065, the Authentication Engine and a Third Party/Apache Mina component, over HTTP or T3/IIOP or TCP/IP). Forms carries five more (CVE-2026-83094, -83095, -83098, -83100, -83108, all in Forms Services/C-S/ Charmode over HTTP). Internet Directory carries five more (CVE-2026-83054, -83060, -83061, -83062, -83066, the OID LDAP Server over LDAP or T3/IIOP). Platform Security for Java carries two more (CVE-2026-82994 over LDAP, CVE-2026-82995 over SOAP, both in the centralized third-party jars). WebLogic Server carries three more (CVE-2026-70756, -70757, -70748, its Core component over T3/IIOP). The remaining thirteen are in other Fusion Middleware components: Data Integrator (CVE-2026-83232, Console/ Repository Explorer, HTTP), Identity Manager (CVE-2026-70913 Core and CVE-2026-83042 OIM Legacy UI, both HTTP), JDeveloper (CVE-2026-73961, ADF Faces, HTTP), WebCenter Enterprise Capture (CVE-2026-83339, Client Bundle, HTTP), WebCenter Portal (CVE-2026-73956 Composer and CVE-2026-73953/-73963 Portlet Services, all HTTP), WebCenter Sites (CVE-2026-83035, -83036, -83037, HTTP) and Service Delivery Platform (CVE-2026-83000 and -83151, Messaging Enabler, over HTTP or SOAP) (Oracle, 2026-09-15). Outside Fusion Middleware there are four more: two further Hyperion Financial Management flaws (CVE-2026-87188 over HTTP, CVE-2026-87184 over SQL, alongside the original CVE-2026-87230), one more in Oracle Analytics (CVE-2026-83269 in BI Publisher's BI Platform Security component, over HTTP, alongside CVE-2026-83283 in Business Intelligence Enterprise Edition), and one in Oracle Supply Chain's Product Lifecycle Analytics (CVE-2026-83261, Core component, HTTP). The total for the release is fifty unauthenticated CVSS 9.8-10.0 flaws.

None of the fifty is reported exploited by Oracle or any other source (Oracle, 2026-09-15), and none appears in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-20 (CISA KEV catalog, 2026-10-20). Oracle E-Business Suite deserves early patching despite the absence of exploitation reporting: Cl0p exploited an earlier Oracle EBS zero-day from early August 2025 to steal files from many organizations (BleepingComputer, 2026-08-17), and an estate running EBS 12.2.3-12.2.15 should treat its three unauthenticated flaws as an extension of that same exposure class rather than a routine patch-cycle item. By count, the exposure is dominated by Fusion Middleware: Access Manager, Forms and Internet Directory alone carry five to six unauthenticated CVSS 9.8-10.0 flaws each, and an estate that patched only the six CVSS 10.0 components has patched a small fraction of what this release actually contains.

Correction30 Sep 2026 06:57 UTCrun 2026-09-30T0639Z-auditheadlinesummaryactionsbodysourcing_notetagscvesverificationsourcespriority

Oracle's risk matrix lists fifty unauthenticated, no-interaction flaws at CVSS 9.8 to 10.0 in this release, not six, and none is reported exploited (Oracle, 2026-09-15). Oracle gives no vulnerability class for any of them, so the earlier authentication-bypass label and the triage guidance that assumed an exploitation mechanism are withdrawn. Oracle now patches monthly, and its next releases are the Critical Patch Update of 20 October 2026 and Critical Security Patch Updates on 17 November and 15 December 2026 (Oracle, 2026-09-15). NCSC-NL relayed the 153 Fusion Middleware fixes and rated likelihood and damage high (NCSC-NL, 2026-09-16). The 2025 E-Business Suite campaign was Cl0p's exploitation of an earlier zero-day (BleepingComputer, 2026-08-17).

Improvement21 Oct 2026 08:09 UTCrun 2026-10-21T0800Z-auditbodysources

As of 2026-10-20 none of the fifty flaws appears in CISA's Known Exploited Vulnerabilities catalog (CISA KEV catalog, 2026-10-20), and Oracle's risk matrix gives no exploitation status for any of them (Oracle, 2026-09-15).

Builds on: 943 patches in a monthly release, and the ones that decide the sequencing are the three needing… · CVE-2026-46978 / CVE-2026-35278, Oracle June 2026 CSPU: unauthenticated Solaris RAD flaw (CVSS…

vulnerability20 Sep 13:38Zsingle-sourceOpen finding →

Sources: Oracle · NCSC-NL · BleepingComputer · CISA KEV catalog

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Oracle E-Business Suite×2
productproduct:oracle-e-business-suite
Oracle Identity Manager×2
productproduct:oracle-identity-manager
Oracle WebLogic Server×2
productproduct:oracle-weblogic-server
Cl0p×1
actoractor:clop
Oracle Access Manager (Authentication Engine), unauthenticated flaw over HTTP, CVSS 10.0, September 2026 CSPU×1
cveCVE-2026-71133
Oracle Access Manager Authentication Engine, unauthenticated CVSS 9.8 flaw, September 2026 CSPU×1
cveCVE-2026-73940
Oracle Access Manager Authentication Engine, unauthenticated CVSS 9.8 flaw, September 2026 CSPU×1
cveCVE-2026-73947
Oracle Access Manager Authentication Engine, unauthenticated CVSS 9.8 flaw, September 2026 CSPU×1
cveCVE-2026-73950

Where this entity is cited

Vulns2

Source distribution

bleepingcomputer.com2 (25%)
oracle.com2 (25%)
advisories.ncsc.nl1 (12%)
cisa.gov1 (12%)
horizon3.ai1 (12%)
securityweek.com1 (12%)

All cited sources (8)