2025-Oracle-SSO-LDAP-Attack-Post-Incident-Written-Report

2025-Oracle-SSO-LDAP-Attack-Post-Incident-Written-Report 本インシデント後レポートは、Oracle Cloudのアイデンティティおよび認証インフラストラクチャを標的とした2025年のサプライチェーン侵害を調査したものです。脅威アクターが、レガシーなOracle Access Manager（OAM）インスタンスにおける未パッチの事前認証リモートコード実行脆弱性（CVE-2021-35587、CVSS...

Oracle-OAM-Padding-Oracle-CVE-2018-2879-Exploit

Oracle-OAM-Padding-Oracle-CVE-2018-2879-Exploit はじめに このエクスプロイトは、Oracle OAM 11.1.2.3.0 に対するペネトレーションテスト中に開発されました。これは、sec-consult による技術解説に基づいて開発されています。 root@kitploit: https://www.sec-consult.com/en/blog/2018/05/oracle-access-managers-identity-crisis/ 要件 このエクスプロイトは python-paddingoracle...

CVE-2021-35587

CVE-2021-35587 説明 - CVE-2021-35587のPOC: 悪用が容易な脆弱性により、HTTP経由でネットワークアクセスを持つ認証されていない攻撃者がOracle Access Managerを侵害できます。 - 作成者: antx、2022年3月14日。 詳細 - Oracle Fusion MiddlewareのOracle Access Manager製品（コンポーネント: OpenSSO Agent）における脆弱性。 - 悪用が容易な脆弱性により、HTTP経由でネットワークアクセスを持つ認証されていない攻撃者がOracle Access...

oracle-oam-authentication-bypas-exploit

Oracle Access Manager OAM 認証バイパスエクスプロイト はじめに Oracle Access Manager OAM のパディングオラクルの脆弱性 CVE-2018-2879 を悪用して、有効なユーザー名を使用して OAM で保護された任意の Web アプリケーションに認証バイパスを行いログインします。 このエクスプロイトは、SEC Consult によって発見された OAM パディングオラクルの脆弱性に基づいており、OAM v12.2.1.3.0 でテストされました。 root@kitploit:...

The vulnerability of the Authentication Engine component of the Oracle Access Manager access control system allows a perpetrator to gain full control over the application.

The vulnerability of the Authentication Engine component in the Oracle Access Manager access control system is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker, operating remotely, to gain full control over the application using...

The vulnerability of the Authentication Engine component of the Oracle Access Manager control system allows a perpetrator to gain full control over the system.

The vulnerability of the Authentication Engine component in the Oracle Access Manager access control system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain full control over the application through the HTTP...

The vulnerability of the Authentication Engine component of the Oracle Access Manager control system allows a perpetrator to gain full control over the system.

The vulnerability of the Authentication Engine component in the Oracle Access Manager access control system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain full control over the system using the HTTP network protocol...

The vulnerability of the Authentication Engine component of the Oracle Access Manager control system allows a perpetrator to gain full control over the system.

The vulnerability of the Authentication Engine component in the Oracle Access Manager access control system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain full control over the system using the HTTP network protocol...

CVE-2026-83369

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Access SDK. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Access...

CVE-2026-83002

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-83001

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-73962

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle...

CVE-2026-73958

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2026-73950

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2026-73941

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2026-73944

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2026-73945

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-73946

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-73947

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2026-73940

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Orac...