This critical vulnerability in Oracle Access Manager allows unauthenticated attackers to achieve a complete system takeover via the SAML infrastructure.

This vulnerability is located within the Agent infrastructure of Oracle Access Manager. It is particularly dangerous because it allows an unauthenticated attacker to exploit the SAML interface over the network to gain full control of the identity management system.

With a CVSS score of 9.8, this flaw poses a massive risk, as Oracle Access Manager is a central component for identity and access control. Compromise of this system could grant an attacker unrestricted access to all integrated applications and services, leading to total organizational data exposure and loss of trust.

Immediate Action: Apply the relevant patches provided by Oracle in the August 2026 security advisory without delay.

Proactive Monitoring: Monitor SAML authentication traffic for unusual patterns or failed assertions that may indicate exploitation attempts.

Compensating Controls: Ensure that all identity management traffic is strictly controlled and that only authorized gateways can communicate with the Access Manager agent infrastructure.

Public Exploit Available: Unknown

This vulnerability is exceptionally severe because it bypasses authentication mechanisms. All organizations utilizing the affected versions of Oracle Access Manager must prioritize this update as the primary defense against unauthorized access to their entire identity infrastructure.