Oracle Access Manager CVE-2026-71133

No special conditions - remote unauthenticated exploitation over HTTP against Oracle Access Manager (Authentication Engine component) versions 12.2.1.4.0 and 14.1.2.1.0, per AV:N/AC:L/PR:N/UI:N. The primary limiting factor is network reachability of the OAM authentication endpoint: OAM is typically fronted by load balancers/reverse proxies and often exposed to intranet or, in federated deployments, the internet, so exposure varies by architecture. Only the two named versions are stated as affected; the scope-change (S:C) means a successful compromise of OAM propagates to downstream applications that rely on it for authentication, amplifying impact beyond the OAM host itself.

This is a genuine top-tier priority, not a high-CVSS-but-low-real-risk artifact. Every CVSS 3.1 signal aligns toward maximum severity: AV:N (remote over HTTP), AC:L (easily exploitable per Oracle), PR:N (unauthenticated), UI:N (no user interaction), S:C (scope change - impact extends beyond OAM to downstream products it federates), and C:H/I:H/A:H yielding a perfect 10.0. The vulnerability sits in the Authentication Engine (CWE-287, Improper Authentication) of Oracle Access Manager, an identity/SSO gateway - compromising it is uniquely damaging because OAM issues authentication decisions for many protected applications, which is exactly why Oracle asserts a scope change. That said, several corroborating exploitation signals are absent from the provided data: no KEV listing, no EPSS score, and no public POC were supplied, so exploitation status must be treated as 'no public exploit identified at time of analysis' despite the ceiling CVSS. This mirrors the historical OAM pre-auth bypass class (e.g., CVE-2021-35587, which was later added to CISA KEV), so real-world weaponization of OAM auth flaws has precedent even though it is not yet confirmed here. Bottom line: patch/mitigate immediately on severity and product-role grounds, but do not overstate active exploitation beyond what the data confirms.

An unauthenticated attacker sends crafted HTTP requests to an internet-facing or intranet-reachable Oracle Access Manager Authentication Engine endpoint, abusing the improper authentication flaw to bypass authentication and take over OAM. Because OAM brokers SSO for downstream applications (scope change), the attacker can then forge or assert authenticated sessions to pivot into protected Fusion Middleware apps. No public POC was provided in the source data, but Oracle rates the flaw 'easily exploitable' with AC:L.