External risk intelligence

Oracle Access Manager Authentication Engine Vulnerability Leads to Takeover

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2026-71133

Oracle Access Manager is an identity management and access control solution designed to be positioned as a public-facing gatekeeper for enterprise applications, making its authentication engine a primary, internet-accessible service by design.

Authentication Bypass

Oracle Access Manager

12.2.1.4.014.1.2.1.0

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in Oracle Access Manager, a component of Oracle Fusion Middleware. This issue could allow an attacker to compromise the system, potentially impacting other connected products. Given the criticality of access management, confirming relevance and exposure is the primary concern.

Attackers can access critical systems remotely.
This affects core identity and access management.
Confirming relevance and exposure is the priority.

Attack Path

How an attacker could exploit the issue

An attacker could reach the Oracle Access Manager's authentication engine without needing any credentials, by simply accessing it over the network. This could allow them to take full control of the Oracle Access Manager, potentially impacting other connected products.

Network access required.
Unauthenticated HTTP request triggers vulnerability.
Takeover of Access Manager.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker with network access to take over Oracle Access Manager. This could significantly impact additional products when they rely on Oracle Access Manager for authentication and authorization.

Oracle Access Manager system.
Network access via HTTP.
Complete takeover of the system.

Operational Fix

Recommended remediation, mitigation, and detection steps

Application owners and infrastructure teams are likely responsible for addressing this critical vulnerability in Oracle Access Manager, as it can be exploited remotely via HTTP and leads to a complete takeover. The first practical step is to identify all instances of Oracle Access Manager, confirm their network accessibility and business criticality, identify the specific system owners, and then prioritize remediation based on risk.

Identify and confirm affected systems.
Determine system owners and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle Access Manager?

Oracle Access Manager is a core component of Oracle Fusion Middleware used by enterprises to manage identities and enforce security policies. It functions as an authentication and authorization gateway, ensuring that users can securely access various applications across an organization's ecosystem.

What does CWE-287 and CWE-306 mean for CVE-2026-71133?

These codes identify weaknesses related to improper authentication and missing authentication for critical functions. In the context of this CVE, it means the system fails to correctly verify the identity of a user or omits these checks entirely during sensitive operations, allowing unauthorized access to the authentication engine.

How can an attacker trigger this vulnerability?

An attacker can initiate the vulnerability by sending a specially crafted, unauthenticated HTTP request directly to the Oracle Access Manager's authentication engine over the network. It does not require valid user credentials or prior interaction with the system to trigger, as the defect exists within the engine's processing logic.

Is my organization at risk if we use this software?

If you run Oracle Access Manager, you should assume high relevance. According to Halo Surface Signal, this product is frequently positioned as a public-facing gatekeeper, meaning the authentication engine is often intentionally exposed to the internet. If your instance is network-accessible, it is a potential target.

What should I do first to address this issue?

Begin by creating a comprehensive inventory of all Oracle Access Manager deployments within your environment. Once you have identified these instances, determine their network connectivity status and business criticality, then work with the designated system owners to schedule and apply the necessary security updates.

References

www.oracle.com/security-alerts/cspusep2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.