CVE-2026-71124 in Access Manager
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authorization Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Access Manager. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Authorization Engine component of Oracle Access Manager, a critical identity and access management solution included in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0. This security flaw is classified as an easily exploitable weakness that permits low-privileged attackers to compromise the integrity of the system by leveraging network connectivity via TCP protocols. The core technical nature of this vulnerability centers on a resource exhaustion condition triggered during specific authorization processing workflows, which ultimately leads to service degradation rather than complete system failure or data exfiltration.
From an operational perspective, successful exploitation allows an attacker with low-level privileges and valid network access to induce a partial denial of service against the Oracle Access Manager infrastructure. This means that while the authentication services may remain partially functional, specific authorization checks can be delayed, dropped, or fail unpredictably due to resource contention caused by maliciously crafted requests. The impact is primarily confined to availability, as indicated by the CVSS 3.1 base score of 4.3, which reflects a medium severity level driven solely by availability impacts with no implications for confidentiality or integrity in this specific context.
This vulnerability aligns closely with CWE-787: Out-of-bounds Write and CWE-20: Improper Input Validation, as the flaw likely stems from insufficient validation of input parameters within the authorization engine logic, leading to memory corruption or resource leaks when processing malformed data streams over TCP connections. In terms of adversary tactics, this aligns with MITRE ATT&CK technique T1498: Network Denial of Service, specifically under sub-techniques involving application layer exhaustion attacks where an attacker floods a service with requests that consume disproportionate resources during complex authorization evaluations.
Mitigation strategies should prioritize the immediate application of vendor-provided security patches to update the Authorization Engine component in affected environments. Organizations must also enforce strict network segmentation policies to ensure that only authorized and trusted subnets can communicate with Oracle Access Manager instances over TCP, thereby reducing the attack surface for low-privileged external actors. Additionally, implementing rate limiting and request validation at the load balancer or web application firewall level can help mitigate potential exploitation attempts by detecting anomalous traffic patterns associated with denial-of-service attacks before they reach the vulnerable component.