CVE-2026-70905
CriticalCVSS 9.8Summary
Vulnerability in Oracle Access Manager (component: Agent infrastructure) allows an unauthenticated attacker with network access via SAML to compromise the system. The attack is easily exploitable and requires no user interaction.
Risk Assessment
The risk is critical as the attacker can fully take over Oracle Access Manager, potentially leading to loss of confidentiality, integrity, and availability of data.
Recommendation
Apply patches provided by Oracle for versions 12.2.1.4.0 and 14.1.2.1.0. Restrict SAML access to trusted networks only.
Original NVD description (English source)
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Agent infrastructure). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SAML to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).