CVE-2026-70905 in Access Manager
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Agent infrastructure). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SAML to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Agent infrastructure component of Oracle Access Manager, a critical identity and access management solution included in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0. This security flaw is characterized by its high severity, with a CVSS 3.1 base score of 9.8, indicating that it poses an immediate and critical risk to organizational infrastructure. The vulnerability allows for unauthenticated exploitation via the Security Assertion Markup Language protocol, commonly known as SAML. Because no prior authentication or user interaction is required, any external actor possessing network access can target this service endpoint directly without needing valid credentials or social engineering tactics.
The technical nature of this flaw centers on improper validation or handling of SAML assertions within the agent infrastructure layer. In a typical enterprise environment, Oracle Access Manager serves as the central policy enforcement point for single sign-on operations across numerous applications and services. The Agent infrastructure is responsible for intercepting authentication requests from client agents and validating them against identity providers. When this component fails to properly sanitize or verify incoming SAML tokens, it creates an opening where maliciously crafted assertions can bypass standard security controls. This lack of rigorous input validation allows attackers to inject arbitrary commands or manipulate session states in ways that the system interprets as legitimate administrative actions rather than unauthorized access attempts.
The operational impact of this vulnerability is severe and comprehensive, affecting all three pillars of the CIA triad: confidentiality, integrity, and availability. Due to the ability to compromise Oracle Access Manager itself, an attacker can achieve full takeover of the identity management platform. This effectively grants the adversary control over who has access to which resources within the organization's digital ecosystem. With this level of privilege escalation, attackers can exfiltrate sensitive user data by manipulating authentication logs and session tokens, thereby compromising confidentiality. They can also alter authorization policies to grant themselves or other malicious actors elevated privileges across connected applications, violating integrity. Furthermore, the ability to disrupt the access manager service can lead to widespread denial of service for dependent systems, impacting availability.
From a threat modeling perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-798 Use of Hard-coded Credentials if specific default configurations are exploited, though the primary issue is likely related to improper validation of security tokens which maps closely to CWE-613 Insufficient Session Expiration. In terms of adversary behavior as defined by MITRE ATT&CK, this exploit facilitates Initial Access through SAML-based authentication bypass and enables Privilege Escalation within the identity management domain. Attackers can leverage this foothold to move laterally across the network with high-level credentials, potentially leading to Domain Persistence if they modify account properties or create new administrative accounts within the integrated Active Directory or LDAP directories managed by Oracle Access Manager.
Mitigation strategies must be implemented immediately given the remote and unauthenticated nature of the exploit. The primary remediation is to apply the latest security patches provided by Oracle for the affected versions 12.2.1.4.0 and 14.1.2.1.0. Organizations should verify their patch levels through official Oracle support channels and prioritize deployment in production environments where this service is exposed to untrusted networks. In addition to patching, network-level controls such as Web Application Firewalls can be configured to inspect SAML traffic for anomalous patterns or malformed assertions that deviate from expected schema structures. It is also advisable to restrict access to the Oracle Access Manager endpoints by IP address if possible, ensuring that only known identity providers and internal client agents can communicate with the service. Regular auditing of authentication logs should be conducted to detect any signs of exploitation attempts involving unexpected SAML token origins or unusual privilege changes within the access manager console.