CVE-2026-70905: Critical severity Oracle Oracle Access Manager vulnerability
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Agent infrastructure). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SAML to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle Fusion Middleware - Oracle Access Manager (Agent infrastructure)to a version that resolves this vulnerability.Fixed in 12.2.1.4.0 - Upgrade
Upgrade
Oracle Fusion Middleware - Oracle Access Manager (Agent infrastructure)to a version that resolves this vulnerability.Fixed in 14.1.2.1.0 - Compensating control
Restrict network access to Oracle Access Manager Agent infrastructure endpoints that handle SAML (since the vulnerability is reachable via SAML and can be exploited by unauthenticated attackers with network access).
Event History
Frequently Asked Questions
Which deployments are affected?
Oracle Access Manager Agent infrastructure deployments running supported versions 12.2.1.4.0 or 14.1.2.1.0 are affected.
What does an attacker need to exploit this issue?
An attacker needs network access to the affected Oracle Access Manager environment via SAML. No authentication, privileges, or user interaction are required.
What is the potential impact of successful exploitation?
Successful exploitation can allow takeover of Oracle Access Manager, with high confidentiality, integrity, and availability impact.