CVE-2026-71124

Received Received - Intake

Authorization Bypass in Oracle Access Manager

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: Oracle

Description

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authorization Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Access Manager. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-18

Generated

2026-08-19

AI Q&A

2026-08-19

EPSS Evaluated

N/A

NVD

CVE-2026-71124

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	access_manager	12.2.1.4.0
oracle	access_manager	14.1.2.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Access Manager, a product under Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.1.0. The issue lies in the Authorization Engine component. An attacker with low privileges and network access can exploit it to cause a partial denial of service (DOS) in Oracle Access Manager.

Impact Analysis

If you use Oracle Access Manager versions 12.2.1.4.0 or 14.1.2.1.0, an attacker could disrupt its availability, leading to partial service outages. This may affect user access to protected resources but does not allow data theft or unauthorized changes.

Compliance Impact

This vulnerability primarily impacts availability, not confidentiality or integrity. While it may not directly violate GDPR or HIPAA, repeated disruptions could affect service reliability, potentially leading to compliance issues if availability is a requirement under these regulations.

Mitigation Strategies

Apply the latest Oracle Access Manager patches from Oracle immediately. Restrict network access to the Authorization Engine component via TCP. Monitor for unusual activity or partial denial of service attempts.

Hi! I’m here to help you understand CVE-2026-71124. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70