CVE-2026-71133

CVE-2026-71133 is a critical vulnerability in the Authentication Engine component of Oracle Access Manager (OAM), part of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.1.0. It is easily exploitable by an unauthenticated attacker with network access via HTTP, requiring no privileges or user interaction, and successful attacks result in complete takeover of Oracle Access Manager. Because the CVSS vector includes a scope change (S:C), compromise of OAM can significantly impact additional products beyond the vulnerable component itself. Any organization exposing an affected OAM deployment — which commonly fronts internet-facing single sign-on and authentication portals — is at risk of full confidentiality, integrity, and availability impact. No public proof of concept is known and the flaw is not on the CISA KEV list, but the unauthenticated, network-exploitable nature makes patching urgent.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-71133 to affected OAM 12.2.1.4.0 and 14.1.2.1.0 deployments as an emergency change, prioritizing any instance reachable from the internet. Until patched, restrict network access to OAM authentication endpoints (VPNs, IP allowlists, WAF rules) and enforce TLS so the HTTP attack path is closed. Review OAM and federation logs for unauthenticated anomalous requests or unexpected administrative changes that could indicate attempted compromise.