CVE-2026-71163: Oracle Access Manager Auth Bypass Vulnerability

CVE-2026-71163 Overview

CVE-2026-71163 is a vulnerability in the Authentication Engine component of Oracle Access Manager, part of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with network access over HTTP can compromise Oracle Access Manager without user interaction. The vulnerability carries a scope change, meaning successful exploitation can impact resources beyond the vulnerable component itself. Oracle disclosed the issue in the Security Alert CSPUSEP2026. The weakness is categorized under improper access control [CWE-284].

Critical Impact
Attackers can gain unauthorized read, create, modify, or delete access to all Oracle Access Manager data and cause partial denial of service across dependent products.

Affected Products

Oracle Access Manager 12.2.1.4.0
Oracle Access Manager 14.1.2.1.0
Oracle Fusion Middleware deployments relying on the Authentication Engine

Discovery Timeline

2026-09-15 - CVE-2026-71163 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-71163

Vulnerability Analysis

The vulnerability resides in the Authentication Engine of Oracle Access Manager, the component responsible for validating credentials and enforcing access decisions across federated Oracle applications. Because Oracle Access Manager brokers authentication for downstream services, a compromise propagates outward, producing the scope change flagged in the advisory.

An attacker requires only low-privileged network access over HTTP to reach the vulnerable code path. Exploitation does not require user interaction, and the attack complexity is low. Successful exploitation grants unauthorized read, write, and delete access to all data accessible through Oracle Access Manager, along with the ability to induce partial denial of service.

The underlying weakness maps to [CWE-284] (Improper Access Control), indicating that the Authentication Engine fails to enforce authorization boundaries correctly for authenticated requests. Oracle has not published deeper technical detail beyond the Security Alert CSPUSEP2026.

Root Cause

The root cause is improper access control within the Authentication Engine. The component does not sufficiently validate the privileges of authenticated callers before performing sensitive operations. This allows a low-privileged principal to reach functionality reserved for higher-trust roles and to act on data across trust boundaries.

Attack Vector

The attack is delivered over the network using HTTP requests to an Oracle Access Manager instance. The attacker must hold a low-privileged authenticated session. Once authenticated, the attacker issues crafted requests to the Authentication Engine to bypass access checks and interact with protected resources or trigger partial service disruption. Because scope changes to affected downstream products, blast radius extends beyond Oracle Access Manager itself.

No public proof-of-concept has been observed. See the Oracle Security Alert CSPUSEP2026 for vendor guidance.

Detection Methods for CVE-2026-71163

Indicators of Compromise

Unexpected administrative or configuration changes within Oracle Access Manager logs performed by low-privileged accounts.
Anomalous HTTP requests to Authentication Engine endpoints originating from accounts that normally do not touch those paths.
Bursts of authentication or authorization errors followed by successful privileged actions.
Partial service degradation or timeouts in Oracle Access Manager coinciding with unusual request patterns.

Detection Strategies

Baseline normal Authentication Engine request patterns per user role and alert on deviations.
Correlate Oracle Access Manager audit logs with downstream Fusion Middleware application logs to detect scope-crossing activity.
Monitor for privilege escalation sequences where a low-privileged session performs actions historically limited to administrators.

Monitoring Recommendations

Forward Oracle Access Manager audit and access logs to a centralized SIEM for retention and correlation.
Enable verbose logging on the Authentication Engine during the remediation window to preserve forensic evidence.
Alert on modifications to policy stores, identity stores, and OAM configuration made outside approved change windows.

How to Mitigate CVE-2026-71163

Immediate Actions Required

Apply the fixes referenced in Oracle Security Alert CSPUSEP2026 to all instances of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0.
Inventory every Oracle Fusion Middleware deployment that integrates with Oracle Access Manager and prioritize internet-exposed instances.
Rotate credentials for accounts with any level of access to Oracle Access Manager and review recent audit logs for anomalous activity.
Restrict network reachability to the Oracle Access Manager HTTP endpoints to trusted management networks until patches are applied.

Patch Information

Oracle has published remediation guidance in Security Alert CSPUSEP2026. Administrators should apply the vendor-supplied patches for the affected versions and validate configuration after patching. Full details are available in the Oracle Security Alert CSPUSEP2026.

Workarounds

Place Oracle Access Manager behind a web application firewall configured to restrict access to Authentication Engine endpoints by source and role.
Enforce network segmentation so that only trusted application tiers can reach OAM HTTP interfaces.
Reduce the number of low-privileged accounts holding valid OAM sessions and enforce stricter session lifetimes until patches are deployed.
Increase audit log verbosity and shorten log rotation intervals to preserve evidence during the exposure window.

bash

# Example: restrict OAM HTTP endpoints to trusted management subnet
iptables -A INPUT -p tcp --dport 14100 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 14100 -j DROP