CVE-2026-71124

Analyzed Analyzed - Analysis Complete

Authorization Bypass in Oracle Access Manager

Publication date: 2026-08-18

Last updated on: 2026-08-20

Assigner: Oracle

Description

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authorization Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Access Manager. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-20

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-06

NVD

CVE-2026-71124

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	access_manager	12.2.1.4.0
oracle	access_manager	14.1.2.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Access Manager, a product under Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.1.0. The issue lies in the Authorization Engine component. An attacker with low privileges and network access can exploit it to cause a partial denial of service (DOS) in Oracle Access Manager.

Detection Guidance

Detection of CVE-2026-71124 requires monitoring Oracle Access Manager for unusual network traffic or partial denial of service events. Check Oracle Access Manager logs for repeated failed authorization attempts or resource exhaustion. Use network monitoring tools like tcpdump or Wireshark to inspect TCP traffic targeting Oracle Access Manager ports. Ensure Oracle Access Manager is updated to the latest patched version.

Impact Analysis

If you use Oracle Access Manager versions 12.2.1.4.0 or 14.1.2.1.0, an attacker could disrupt its availability, leading to partial service outages. This may affect user access to protected resources but does not allow data theft or unauthorized changes.

Compliance Impact

This vulnerability primarily impacts availability, not confidentiality or integrity. While it may not directly violate GDPR or HIPAA, repeated disruptions could affect service reliability, potentially leading to compliance issues if availability is a requirement under these regulations.

Mitigation Strategies

Apply the latest Oracle Access Manager patches from Oracle immediately. Restrict network access to the Authorization Engine component via TCP. Monitor for unusual activity or partial denial of service attempts.

Hi! I’m here to help you understand CVE-2026-71124. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70