# CVE-2026-71163: Oracle Access Manager authentication bypass in HTTP

Source: https://junglewise.ai/threats/cve-2026-71163-oracle-access-manager-authentication-bypass-in-http  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-71163 · Severity: critical · CVSS 9.9 · Published 2026-09-15

Oracle Access Manager is a critical identity and access control system used to protect enterprise applications and data by managing user authentication and authorization. This vulnerability allows an attacker with low-level credentials and network access to bypass authentication controls via HTTP, leading to unauthorized access to sensitive data, modification of critical information, and potential service disruption across Oracle Fusion Middleware and connected systems.

Technologies: [Oracle Access Manager](https://junglewise.ai/threats/technologies/access-manager). Vendors: [Oracle](https://junglewise.ai/threats/vendors/oracle).

## Quick answers

**Is CVE-2026-71163 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-71163 being exploited in the wild.

**How severe is CVE-2026-71163?** Critical severity, with a CVSS score of 9.9, published 15 September 2026.

**Which products and versions are affected?** Oracle Access Manager 12.2.1.4.0, 14.1.2.1.0.

**Is there a fix for CVE-2026-71163?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-71163 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-71163?** Check whether you run Oracle Access Manager at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is an authentication bypass vulnerability in the Oracle Access Manager Authentication Engine, exploitable with low-privilege network access via HTTP (no authentication required beyond network reachability, though advisory mentions "low privileged attacker"). The vulnerability has a CVSS 3.1 score of 9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L), indicating network attack vector with low complexity and changed scope. Successful exploitation permits unauthorized creation, deletion, or modification of critical data; complete access to all Oracle Access Manager-accessible data; confidentiality, integrity, and availability impacts; and partial denial of service. Affected versions are 12.2.1.4.0 and 14.1.2.1.0. Patch availability was expected as of the September 2026 security advisory, though the external Oracle reference URL was inaccessible at time of analysis.

## Affected products

- Oracle Access Manager 12.2.1.4.0, 14.1.2.1.0

## Timeline

- 2026-09-15: disclosed: Public disclosure via Oracle security alert

## References

- [https://www.oracle.com/security-alerts/cspusep2026.html](https://www.oracle.com/security-alerts/cspusep2026.html)

## Related threats

- [Oracle Access Manager authentication bypass in HTTP](https://junglewise.ai/threats/cve-2026-87337-vulnerability-in-the-oracle-access-manager-product-of-oracle)
- [Oracle Access Manager authentication bypass via HTTP](https://junglewise.ai/threats/cve-2026-87296-vulnerability-in-the-oracle-access-manager-product-of-oracle)
- [Oracle Access Manager authentication bypass in SAML](https://junglewise.ai/threats/cve-2026-87251-vulnerability-in-the-oracle-access-manager-product-of-oracle)
- [Oracle Access Manager authentication bypass in HTTP](https://junglewise.ai/threats/cve-2026-83426-vulnerability-in-the-oracle-access-manager-product-of-oracle)
- [Oracle Access Manager SAML authentication bypass](https://junglewise.ai/threats/cve-2026-83409-vulnerability-in-the-oracle-access-manager-product-of-oracle)