CVE-2026-71133: Oracle Access Manager Flaw
TL;DR - CVE-2026-71133 is a CVSS 10.0 unauthenticated remote compromise flaw in Oracle Access Manager. - Versions 12.2.1.4.0 and 14.1.2.1.0 are affected; restrict HTTP access and consult Oracle’s September 2026 CPU. - No verified public PoC, confirmed in-the-wild exploitation, or CISA KEV listing was identified.
Vulnerability at a Glance
CVE-2026-71133 is a critical Oracle Access Manager vulnerability affecting the Authentication Engine, a component of Oracle Fusion Middleware. NVD rates the issue Critical with a CVSS 3.1 base score of 10.0. It is remotely exploitable over HTTP without authentication or user interaction.
| Field | Details |
|---|---|
| CVE ID | CVE-2026-71133 |
| Product | Oracle Access Manager |
| Component | Authentication Engine |
| CVSS | 10.0 Critical |
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| Attack vector | Network, via HTTP |
| Authentication required | None |
| User interaction | None |
| Privileges required | None |
| Affected versions | 12.2.1.4.0 and 14.1.2.1.0 |
| Patch status | Oracle September 2026 CPU published; specific fixed version is not exposed in the available record |
| CISA KEV status | Not listed as of the assessment date |
The risk is especially significant for internet-facing or broadly reachable identity infrastructure. Successful exploitation could result in takeover of Oracle Access Manager and may affect additional products because the CVSS scope is changed.
A patch should not be deferred solely because the CVE is not listed in CISA’s Known Exploited Vulnerabilities catalog. The vulnerability requires no credentials, has low attack complexity, and affects an authentication platform. Those characteristics make rapid exploitation plausible after technical details or reliable exploit code become available.
What Is This Vulnerability?
The available NVD description identifies the vulnerable component as the Oracle Access Manager Authentication Engine. It describes an unauthenticated attacker using HTTP to compromise Oracle Access Manager, but it does not disclose a more specific root-cause category such as injection, unsafe deserialization, memory corruption, authentication bypass, or an access-control failure.
Because the underlying defect has not been publicly characterized in the available source material, defenders should avoid assuming that a narrow application-layer control will block exploitation. The confirmed conditions are that the attacker needs network access to the service, does not need an account, does not need victim interaction, and can operate with low attack complexity.
The CVSS scope designation of S:C indicates that exploitation can affect resources beyond the security authority of the vulnerable Oracle Access Manager component. In practical terms, compromise of an access-management platform may provide a path to broader identity, application, or administrative impact, although the available record does not specify every downstream product or attack path.
Technical Notes
The confirmed technical description is limited. There is no verified exploit request, payload, endpoint, or protocol signature in the supplied research. Security teams should therefore treat generic HTTP traffic as potentially relevant rather than waiting for a vendor-published exploit signature.
Do not infer that a request is benign because it targets a normal authentication endpoint. Review the full request path, method, parameters, response status, source address, timing, and subsequent administrative or configuration activity. Any detection rule should be validated against the organization’s Oracle Access Manager deployment before blocking production traffic.
Who Is Affected?
NVD identifies two supported Oracle Access Manager versions as affected:
| Product | Affected version |
|---|---|
| Oracle Access Manager | 12.2.1.4.0 |
| Oracle Access Manager | 14.1.2.1.0 |
Oracle Access Manager is distributed as part of Oracle Fusion Middleware. Organizations should inventory standalone and clustered deployments, including instances behind reverse proxies, load balancers, web application firewalls, and identity gateways. A service may be affected even when the Oracle application server itself is not directly reachable from the internet.
The available record does not identify other affected versions, unsupported releases, or development builds. Organizations running a different version should verify it directly against Oracle’s September 2026 Critical Patch Update documentation rather than assuming it is unaffected. Unsupported versions also require special attention because Oracle may provide remediation only through an upgrade path or supported maintenance release.
A deployment should be considered exposed if an attacker-controlled network can reach the relevant HTTP service, even if the service is not publicly addressed. Internal exposure matters because compromise of a workstation, VPN account, cloud workload, or adjacent server could provide network access.
CVSS Score Breakdown
The CVSS 3.1 vector is:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
| Metric | Value | Meaning |
|---|---|---|
| Attack Vector | Network (AV:N) |
The attack can be performed remotely over a network. |
| Attack Complexity | Low (AC:L) |
No unusual or difficult conditions are indicated. |
| Privileges Required | None (PR:N) |
The attacker does not need an account or existing privileges. |
| User Interaction | None (UI:N) |
No victim action is required. |
| Scope | Changed (S:C) |
Impact can cross the vulnerable component’s security authority. |
| Confidentiality | High (C:H) |
Successful exploitation can expose protected information. |
| Integrity | High (I:H) |
Successful exploitation can alter systems, data, or configuration. |
| Availability | High (A:H) |
Successful exploitation can disrupt or take over the service. |
The 10.0 score reflects the combination of remote reachability, no authentication requirement, no user interaction, and high impact across all three CIA dimensions. The changed-scope value increases business risk because Oracle Access Manager is an identity control point rather than an isolated application.
CVSS is a severity measure, not a prediction that exploitation is occurring. Risk owners should combine the score with exposure, asset criticality, compensating controls, and evidence from logs. An internal-only instance may have lower immediate exposure than an internet-facing deployment, but it still warrants urgent remediation because internal attackers and compromised hosts may be able to reach it.
Exploitation Status
As of September 15, 2026, no verified public proof-of-concept repository or exploit was identified in the sources checked. No confirmed in-the-wild exploitation evidence was identified, and CVE-2026-71133 was not present in the CISA Known Exploited Vulnerabilities catalog during the stated lookup.
These findings describe the available evidence, not a guarantee of safety. The absence of a public PoC or KEV listing does not prevent private exploitation, targeted attacks, or rapid weaponization. Oracle Access Manager is an attractive target because it participates in authentication and access control for enterprise applications.
Security teams should classify this as a high-priority exposure even without confirmed exploitation. Internet-facing instances, systems with direct HTTP reachability from untrusted network segments, and deployments protecting high-value applications should receive the fastest response.
How to Detect It
Start by identifying every Oracle Access Manager deployment and determining whether the Authentication Engine is reachable over HTTP from untrusted networks. Review load balancer, reverse-proxy, web server, Oracle Fusion Middleware, authentication, and administrative logs. Preserve logs before rotating or deleting them, particularly if compromise is suspected.
Teams investigating a suspected breach can also review this Windows digital forensics guide when examining administrator workstations or connected Windows systems.
Look for unauthenticated HTTP requests followed by unusual Authentication Engine errors, unexpected success responses, administrative activity, configuration changes, new accounts, altered federation settings, or access to downstream applications. Because no exploit-specific request pattern has been published in the available material, anomaly detection and correlation are more reliable than a single string match.
Technical Notes
A generic reverse-proxy or web access log review can begin with requests that have no authenticated principal. Field names vary by product and logging format, so adapt the query to the local schema:
index=web OR index=proxy
product="Oracle Access Manager"
(authenticated_user="-" OR user="-" OR principal="anonymous")
(method IN ("GET","POST","PUT","DELETE"))
| stats count min(_time) as first_seen max(_time) as last_seen
values(uri_path) as paths values(status) as statuses
by src_ip user_agent host
| where count >= 1
The following shell pattern can help identify unauthenticated requests in common access-log formats. It is not an exploit signature and should be used for triage, not as proof of exploitation:
awk '$0 ~ /" (GET|POST|PUT|DELETE) / &&
($0 ~ / 200 / || $0 ~ / 201 / || $0 ~ / 302 / || $0 ~ / 500 /)' \
/var/log/*access*.log
Correlate suspicious requests with Oracle Access Manager administrative events, configuration changes, new authentication policies, unexpected process activity, and downstream login anomalies. If takeover is suspected, isolate the service while preserving forensic evidence and investigate tokens, credentials, federation trust relationships, and connected applications.
For endpoint triage on administrator workstations involved in the investigation, organizations may also evaluate Malwarebytes security software as part of their broader defensive tooling. It should complement, not replace, server-side logging and forensic analysis.
Mitigation and Patching
Oracle’s September 2026 Critical Security Patch Update is the authoritative remediation source. The available NVD record and retrieved Oracle advisory content do not expose a specific fixed-version number for CVE-2026-71133. Therefore, this article cannot safely name a fixed Oracle Access Manager release. Administrators must use Oracle’s product-specific patch availability documentation to identify the applicable patch ID or upgrade target for their installation.
The affected versions requiring immediate review are Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0. Confirm the installed version and patch inventory, obtain the Oracle-provided fix through the organization’s Oracle support entitlement, test it in a representative environment, and deploy it across all nodes in a cluster. Confirm afterward that every node reports the expected patched inventory.
Organizations tracking Oracle’s recurring security updates may also find this Patch Tuesday glossary entry useful for understanding how vendor security-release cycles fit into vulnerability-management workflows.
Technical Notes
The exact Oracle patch ID is not available in the supplied research, so do not substitute an unverified number. After obtaining the correct Oracle patch package, a typical OPatch workflow is:
export ORACLE_HOME=/path/to/oracle_home
"$ORACLE_HOME/OPatch/opatch" lsinventory
"$ORACLE_HOME/OPatch/opatch" prereq CheckConflictAgainstOHWithDetail \
-phBaseDir /path/to/CVE-2026-71133-oracle-patch
"$ORACLE_HOME/OPatch/opatch" apply /path/to/CVE-2026-71133-oracle-patch
"$ORACLE_HOME/OPatch/opatch" lsinventory
Oracle’s supplied instructions and patch README take precedence over this generic command sequence. Follow the documented shutdown, backup, cluster-ordering, rollback, and post-installation validation steps.
Until the applicable fix is installed, restrict access to the Oracle Access Manager HTTP service at the network boundary. For example, an organization using a Linux firewall can deny inbound access to the service port from untrusted networks, substituting the actual port and approved management subnet:
sudo nft add rule inet filter input ip saddr != 10.20.0.0/16 \
tcp dport 14100 drop
The port in this example is illustrative and must not be assumed to be Oracle Access Manager’s configured port. Apply controls at the load balancer, security group, firewall, or reverse proxy using the actual service configuration. Do not rely on a WAF rule as a permanent substitute for the Oracle fix, especially because no validated exploit signature is currently available.
If compromise is suspected, isolate affected nodes, preserve logs and memory where feasible, rotate credentials and tokens associated with Oracle Access Manager, review federation and administrative configuration, and investigate connected applications for unauthorized access.
References
- Oracle Critical Patch Update Advisory, September 2026
- NVD: CVE-2026-71133
- CISA Known Exploited Vulnerabilities Catalog
The references identify the affected product, severity, attack characteristics, and Oracle’s September 2026 security update. The available sources do not provide a verified public PoC, confirmed in-the-wild exploitation evidence, exploit-specific network signature, or a product-specific fixed-version number. Defenders should verify those details through Oracle’s current patch documentation and support channels before finalizing remediation status.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.