CVE-2026-71124: 
Oracle Access Manager vulnerability analysis and mitigation

CVE-2026-71124 is a partial denial-of-service vulnerability in the Authorization Engine component of Oracle Access Manager, part of Oracle Fusion Middleware. It affects supported versions 12.2.1.4.0 and 14.1.2.1.0. The vulnerability was published on August 18, 2026, as part of Oracle's Critical Security Patch Update (CSPU) for August 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) (Oracle CSPU Aug 2026, NVD).

The vulnerability resides in the Authorization Engine component of Oracle Access Manager and is exploitable by a low-privileged attacker with network access via TCP. No specific CWE classification has been assigned by NVD at this time. The attack requires no user interaction and has low attack complexity, meaning a network-authenticated attacker can reliably trigger the partial denial-of-service condition without special configuration or timing. No public technical write-ups or proof-of-concept code have been identified (Oracle CSPU Aug 2026, NVD).

Successful exploitation results in a partial denial of service (partial DOS) affecting the availability of Oracle Access Manager. There is no impact on confidentiality or integrity — the vulnerability is limited to availability degradation. Because Oracle Access Manager serves as an identity and access management gateway, even partial availability disruption could impair authentication and authorization services for dependent applications (Oracle CSPU Aug 2026, NVD).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-71124. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. While the low attack complexity and absence of user interaction lower the barrier for exploitation, the requirement for low-privileged network access and the limited impact (partial availability only) reduce its overall attractiveness to threat actors.

Oracle has addressed this vulnerability in the August 2026 Critical Security Patch Update (CSPU). Affected organizations running Oracle Access Manager versions 12.2.1.4.0 or 14.1.2.1.0 should apply the relevant patches from the Fusion Middleware patch availability documentation as soon as possible. As a temporary measure, Oracle recommends blocking TCP network access to Oracle Access Manager from untrusted or unnecessary network sources, though this may impact functionality and is not a long-term solution (Oracle CSPU Aug 2026).