CVE-2026-71133: Critical severity Oracle Oracle Access Manager vulnerability
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Oracle Access Manager deployments running affected supported versions 12.2.1.4.0 or 14.1.2.1.0 are exposed if an attacker can reach the Authentication Engine over HTTP.
Does exploitation require an account or user interaction?
No. The vulnerability is described as easily exploitable by an unauthenticated attacker with network access via HTTP, with no user interaction required.
What could a successful attacker achieve?
Successful exploitation can result in takeover of Oracle Access Manager, with high impact to confidentiality, integrity, and availability. The scope change indicates that attacks may also significantly affect additional products.