CVE-2026-71163 is a critical vulnerability in the Authentication Engine of Oracle Access Manager within Oracle Fusion Middleware. It affects supported versions 12.2.1.4.0 and 14.1.2.1.0. The flaw allows a low privileged attacker with network access over HTTP to compromise the Oracle Access Manager, resulting in unauthorized creation, deletion, or modification of critical data, unauthorized access to all accessible data, and the ability to cause a partial denial of service. The vulnerability has a CVSS 3.1 base score of 9.9 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality and integrity with a low impact on availability. Oracle has included fixes for this vulnerability in their September 2026 Critical Security Patch Update, which contains 673 security patches across multiple products including Oracle Access Manager.

Successful exploitation of this vulnerability can lead to unauthorized creation, deletion, or modification of critical data within Oracle Access Manager, unauthorized access to all data accessible by Oracle Access Manager, and the ability to cause a partial denial of service. The vulnerability affects confidentiality, integrity, and availability, with a critical CVSS score of 9.9. The scope of impact may extend beyond Oracle Access Manager to additional Oracle products.

Oracle has released security patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the relevant patches for Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 without delay. Oracle strongly recommends remaining on actively supported versions and promptly applying all security patches to prevent exploitation. No alternative mitigations or workarounds are indicated in the vendor advisory.