CVE-2026-71133 Oracle CVE debrief

Who should care

Defenders responsible for Oracle Access Manager deployments, particularly those using versions 12.2.1.4.0 and 14.1.2.1.0, should assess exposure and prioritize remediation. This includes verifying exposure, assessing network access controls, and applying vendor remediation as available. The vulnerability's critical nature and potential impact on additional products due to scope change necessitate immediate attention.

Why it matters

CVE-2026-71133 is a critical vulnerability in Oracle Access Manager that allows unauthenticated attackers to compromise the product, potentially impacting additional ones. Defenders should prioritize verifying exposure, assessing network access controls, and applying vendor remediation.

• Potential takeover of Oracle Access Manager
• Possible impact on additional products due to scope change
• Need for verification of affected versions and exposure
• Priority for applying vendor remediation

Technical summary

The vulnerability in Oracle Access Manager (component: Authentication Engine) allows unauthenticated attackers with network access via HTTP to compromise the product, potentially impacting additional ones. Successful attacks can result in takeover of Oracle Access Manager. The CVSS 3.1 Base Score is 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). Defenders should prioritize verifying exposure of Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0, assessing network access controls, and applying vendor remediation.

Defensive priority

Defenders should prioritize verifying exposure of Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0, assessing network access controls, and applying vendor remediation.

Recommended defensive actions

• Verify exposure of Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 in your environment
• Assess network access controls to restrict HTTP access to Oracle Access Manager
• Apply vendor remediation as available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability in Oracle Access Manager, its impact, and affected versions. The vulnerability is in the Authentication Engine component, and successful attacks can result in takeover of Oracle Access Manager. Defenders should verify exposure of Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0, assess network access controls, and apply vendor remediation as available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.