CVE-2026-71163

CVE-2026-71163 is a critical (CVSS 9.9) vulnerability in the Authentication Engine component of Oracle Access Manager, affecting versions 12.2.1.4.0 and 14.1.2.1.0. It is easily exploitable by a low-privileged (i.e., authenticated but unprivileged) attacker with network access to the OAM service over HTTP, requiring no user interaction. Because the CVSS scope is changed, successful attacks on OAM can also significantly impact additional products beyond Oracle Access Manager itself. A successful exploit grants unauthorized creation, deletion, or modification of critical OAM-accessible data, full read access to that data, and the ability to cause a partial denial of service. No public proof of concept is known and the flaw is not on the CISA KEV list, so there is no evidence of in-the-wild exploitation, but internet-facing OAM deployments remain high-value targets.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-71163 to all OAM 12.2.1.4.0 and 14.1.2.1.0 installations as soon as possible, prioritizing internet-facing instances. Until patched, restrict HTTP access to OAM endpoints (VPN/IP allowlisting), enforce MFA and least-privilege for all accounts that can reach OAM, and monitor OAM logs for anomalous data modification or availability degradation. Inventory Fusion Middleware deployments to confirm no unpatched 12.2.1.4.0 or 14.1.2.1.0 OAM servers remain.