CVE-2026-71133: Oracle Access Manager Auth Bypass Flaw

CVE-2026-71133 Overview

CVE-2026-71133 is a critical authentication vulnerability in the Authentication Engine component of Oracle Access Manager, part of Oracle Fusion Middleware. An unauthenticated attacker with network access via HTTP can compromise Oracle Access Manager without user interaction. The flaw carries a scope change, meaning successful exploitation can impact additional products beyond Oracle Access Manager itself. Affected versions include 12.2.1.4.0 and 14.1.2.1.0. Successful exploitation results in a complete takeover of Oracle Access Manager, undermining the confidentiality, integrity, and availability of dependent systems. The vulnerability is classified under CWE-287: Improper Authentication.

Critical Impact
An unauthenticated remote attacker can take over Oracle Access Manager over HTTP, with cascading impact to systems relying on it for authentication and single sign-on.

Affected Products

Oracle Access Manager 12.2.1.4.0
Oracle Access Manager 14.1.2.1.0
Downstream Oracle Fusion Middleware components relying on Oracle Access Manager for authentication (scope change)

Discovery Timeline

2026-09-15 - CVE-2026-71133 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-71133

Vulnerability Analysis

The vulnerability resides in the Authentication Engine of Oracle Access Manager (OAM), which brokers authentication and single sign-on decisions for Oracle Fusion Middleware and integrated enterprise applications. An unauthenticated attacker sends crafted HTTP requests directly to the Authentication Engine and bypasses expected identity verification. Because OAM issues session tokens and authorization assertions consumed by other applications, a compromised OAM instance can authorize attacker-controlled sessions across every relying application. This produces the scope change reflected in the CVSS vector and elevates the effective blast radius well beyond a single product.

Root Cause

The underlying weakness is CWE-287: Improper Authentication. The Authentication Engine fails to correctly verify a claimed identity before granting authenticated context. Oracle has not published implementation-level detail in the public advisory. Refer to the Oracle Security Alert CSPUSEP2026 for vendor-supplied information.

Attack Vector

Exploitation requires only network reachability to the Oracle Access Manager HTTP endpoint. No credentials, no user interaction, and no elevated privileges are needed. Because OAM is typically internet-exposed to serve authentication flows for portals and federation partners, the attack surface is broad. A successful attacker gains administrative control of OAM and can mint valid sessions for any protected downstream application, effectively impersonating any user or service that trusts OAM.

No verified proof-of-concept code is publicly available at the time of publication. See the Oracle Security Alert CSPUSEP2026 for authoritative technical details.

Detection Methods for CVE-2026-71133

Indicators of Compromise

Unexpected administrative or configuration changes within Oracle Access Manager consoles and policy stores.
Authentication success events for accounts from unusual source IP addresses, geographies, or user agents.
Session tokens or OAM cookies issued without a corresponding credential validation event in logs.
New or modified OAM agents, webgates, or identity providers appearing without a change ticket.

Detection Strategies

Inspect OAM access and audit logs for HTTP requests to Authentication Engine endpoints that return authenticated responses without a preceding credential submission.
Correlate downstream application logins against OAM session issuance to surface tokens without a valid authentication chain.
Alert on privilege changes, policy edits, or agent registrations performed outside approved maintenance windows.

Monitoring Recommendations

Forward OAM, WebLogic, and OHS access logs to a centralized SIEM and retain them for extended forensic review.
Baseline normal Authentication Engine request volumes and alert on statistical anomalies.
Monitor egress from OAM hosts for outbound connections that could indicate post-exploitation command-and-control activity.

How to Mitigate CVE-2026-71133

Immediate Actions Required

Apply the fixes distributed in the Oracle Security Alert CSPUSEP2026 to all 12.2.1.4.0 and 14.1.2.1.0 deployments as the top priority.
Restrict network access to Oracle Access Manager HTTP endpoints to trusted networks and reverse proxies pending patch deployment.
Rotate OAM administrative credentials, signing keys, and any shared secrets used with WebGates and federation partners after patching.
Review OAM audit logs for the period preceding the patch to identify any suspicious authentication events.

Patch Information

Oracle published fixes in the out-of-cycle security alert CSPUSEP2026. Administrators should apply the relevant Oracle Access Manager patches for versions 12.2.1.4.0 and 14.1.2.1.0 following Oracle's Fusion Middleware patching procedures, including any prerequisite bundle or Stack Patch Bundle requirements.

Workarounds

Place Oracle Access Manager behind a web application firewall configured to inspect and restrict traffic to Authentication Engine paths.
Enforce network segmentation and IP allow-listing on OAM management and authentication endpoints.
Disable or block unused authentication schemes and endpoints to minimize the reachable attack surface.

bash

# Example: restrict inbound access to OAM Authentication Engine at the firewall layer
# Replace ALLOWED_CIDR and OAM_HOST with values appropriate for your environment
iptables -A INPUT -p tcp --dport 14100 -s ALLOWED_CIDR -d OAM_HOST -j ACCEPT
iptables -A INPUT -p tcp --dport 14100 -d OAM_HOST -j DROP