Oracle Access Manager CVE-2026-71163

Requires network HTTP access to the Oracle Access Manager Authentication Engine and a low-privileged authenticated foothold (PR:L) - not fully unauthenticated, so an attacker needs at least minimal valid access or a reachable authenticated interface. Affected deployments are specifically Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 within Oracle Fusion Middleware. The limiting factors are the low-privilege authentication requirement and version scope; the amplifying factor is the scope change, meaning a compromise of OAM can extend to other products that depend on it for SSO/authentication. No user interaction is required (UI:N) and attack complexity is low (AC:L).

This is a genuine high priority. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L, score 9.9) describes an easily exploitable network-reachable flaw in Oracle Access Manager's Authentication Engine that requires only low privileges and no user interaction, with a scope change that lets impact spill into other products protected by OAM SSO. The confidentiality and integrity impacts are High and availability is Low (partial DoS). Oracle self-assigns 9.9 largely because of the scope change plus full C/I compromise; this is consistent with the description and the assessed vector agrees. However, key exploitation signals are MISSING from the input: no EPSS score, no CISA KEV entry, and no POC are provided, so real-world exploitation likelihood cannot be corroborated beyond the theoretical severity. Exploitation status is therefore: no public exploit identified at time of analysis. The description is Oracle Critical Patch Update boilerplate and contains no CWE (marked N/A) or specific vulnerability class, so the exact mechanism is unconfirmed. Net: treat as high-priority patching for any exposed OAM deployment because it is authenticated-but-low-privilege, network-facing, and touches an identity/SSO chokepoint, but note the elevated 9.9 is driven by scope change rather than confirmed in-the-wild activity.

A low-privileged user with a valid but minimal account (or any principal able to reach the OAM authentication HTTP endpoints) sends crafted requests to the Authentication Engine to gain unauthorized read/modify/delete access to critical OAM-managed data. Because OAM brokers single sign-on, a successful attack crosses a trust boundary (scope change) and can impact downstream applications and identities that rely on it. No public proof-of-concept is identified at the time of analysis.