EXPOSURES › CVE-2026-70905
CVE-2026-70905
CRITICALUnauthenticated attackers can take over Oracle Access Manager via SAML-based network access.
This critical vulnerability allows remote takeover of Oracle Access Manager without authentication, directly impacting DIB organizations relying on Oracle Fusion Middleware for identity and access management. The ease of exploitation and high CVSS score mean unpatched systems face immediate compromise, violating CMMC/NIST 800-171 requirements for patch management and system integrity. Organizations must verify patch levels for Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 and isolate affected systems until patched.
Shame score — A critical, easily exploitable vulnerability in an identity management product that allows unauthenticated remote takeover represents a severe negligence in securing foundational access control infrastructure.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Agent infrastructure). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SAML to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
| PRODUCT | STATUS |
|---|---|
| Aconex for Defense Oracle |
Authorized |
| Federal Managed Cloud Services Oracle |
Authorized |
| Fusion Cloud Oracle |
Authorized |
| Government Cloud - Common Controls Oracle |
Authorized |
| Oracle Cloud Infrastructure-Government Cloud Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) - Moderate Oracle |
In Process |
| Oracle Service Cloud Oracle |
Authorized |
| Oracle Service Cloud (DOD) Oracle |
Authorized |
| Taleo Cloud - U.S. Government Cloud Oracle |
Authorized |