CVE-2026-71124: Oracle Access Manager DOS Vulnerability

CVE-2026-71124 Overview

CVE-2026-71124 is a medium-severity vulnerability in the Authorization Engine component of Oracle Access Manager, part of Oracle Fusion Middleware. The flaw allows a low-privileged attacker with network access via TCP to trigger a partial denial of service against the affected service. Oracle disclosed the issue in the Oracle Security Alert of August 2026. The weakness is categorized under [CWE-284: Improper Access Control]. Exploitation does not require user interaction and does not impact confidentiality or integrity, only availability.

Critical Impact
Authenticated attackers can degrade Oracle Access Manager availability over the network, disrupting single sign-on and authorization decisions that depend on the service.

Affected Products

Oracle Access Manager 12.2.1.4.0
Oracle Access Manager 14.1.2.1.0
Oracle Fusion Middleware deployments using the Authorization Engine component

Discovery Timeline

2026-08-18 - CVE-2026-71124 published to NVD
2026-08-20 - Last updated in NVD database
August 2026 - Oracle addresses the issue in the Oracle Security Alert August 2026

Technical Details for CVE-2026-71124

Vulnerability Analysis

The vulnerability resides in the Authorization Engine component of Oracle Access Manager (OAM), which evaluates policy decisions for protected resources across Oracle Fusion Middleware. A low-privileged authenticated attacker with TCP network reachability to OAM can send crafted requests that cause the engine to enter a degraded processing state. The result is a partial denial of service that impacts availability without leaking data or altering stored policy. Because OAM often fronts enterprise single sign-on and federation flows, degraded availability propagates to downstream applications relying on OAM for authorization decisions.

Root Cause

The root cause is improper access control within the Authorization Engine, tracked as [CWE-284]. The component fails to adequately constrain how low-privileged users can invoke resource-intensive authorization paths. This design gap enables authenticated callers to influence engine behavior beyond their intended privilege scope, producing availability degradation.

Attack Vector

Exploitation requires network access via TCP to the Oracle Access Manager endpoint and valid low-privileged credentials. No user interaction is required, and attack complexity is low. The impact is scoped to availability only; confidentiality and integrity remain unaffected. Oracle has not published exploitation code, and no public proof-of-concept is available at the time of writing.

No verified exploit code is available. See the Oracle Security Alert August 2026 for vendor technical details and patch mapping.

Detection Methods for CVE-2026-71124

Indicators of Compromise

Repeated authorization requests from a single authenticated principal that correlate with OAM response-time spikes or thread-pool saturation.
Elevated error rates or timeouts in OAM oam_server logs, particularly within Authorization Engine handlers.
Downstream application login failures or SSO timeouts that align with OAM performance degradation.

Detection Strategies

Baseline normal Authorization Engine throughput and alert on sustained deviations in request latency or CPU utilization on OAM managed servers.
Correlate authenticated user activity with resource consumption to identify low-privileged accounts generating disproportionate authorization load.
Ingest OAM audit and diagnostic logs into a centralized analytics platform for cross-source correlation with WebLogic and network telemetry.

Monitoring Recommendations

Monitor WebLogic managed server health metrics, JVM thread state, and heap usage for OAM domains.
Track TCP connection counts and request rates to OAM endpoints from individual source IPs and service accounts.
Enable enhanced audit logging on the Authorization Engine and forward events to a SIEM for retention and hunting.

How to Mitigate CVE-2026-71124

Immediate Actions Required

Apply the fixes from the Oracle Security Alert August 2026 to all OAM 12.2.1.4.0 and 14.1.2.1.0 deployments.
Inventory Oracle Fusion Middleware environments and confirm which instances expose OAM to untrusted networks.
Rotate or review credentials for low-privileged OAM accounts that could be leveraged for authenticated abuse.

Patch Information

Oracle addressed CVE-2026-71124 in the August 2026 Critical Patch Update cycle. Administrators should follow the patch application steps published in the Oracle Security Alert August 2026 and validate patch levels against the referenced Oracle Fusion Middleware bundle patches for versions 12.2.1.4.0 and 14.1.2.1.0.

Workarounds

Restrict TCP network access to OAM endpoints using network segmentation and firewall rules, allowing only trusted application tiers.
Enforce rate limiting and connection throttling in front of OAM through a reverse proxy or web application firewall.
Reduce the attack surface by disabling unused OAM features and pruning inactive low-privileged accounts.

bash

# Configuration example: restrict OAM managed server access at the network layer
# Replace <oam_host>, <trusted_cidr>, and <oam_port> with environment values
iptables -A INPUT -p tcp -s <trusted_cidr> --dport <oam_port> -j ACCEPT
iptables -A INPUT -p tcp --dport <oam_port> -j DROP