PatchTheCVECVE-2026-71124: Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authorization Engin
21
Routine
MEDIUM 4.3DOWNGRADE
CVE-2026-71124 is a medium-severity flaw (CVSS 4.3) affecting access manager. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authorization Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle
Why this priority
- No elevated risk signals yet
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 4.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 75%) |
| CISA exploited list | No |
| Weakness | CWE-284 |
| Published | 2026-08-18 |
| Last modified | 2026-10-22 |
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
oracle access manager DOWNGRADE
Affected: 12.2.1.4.0 · 14.1.2.1.0
Fixed in: no fixed release known
Safe to downgrade to: a release before 12.2.1.4.0
1. Check installed version
apt-cache policy access-manager || rpm -q access-manager || access-manager --version
2. No fixed release: DOWNGRADE to a release before 12.2.1.4.0 (Debian / Ubuntu)
apt-cache madison access-manager
sudo apt install access-manager=<VERSION_BEFORE_12.2.1.4.0>
sudo apt-mark hold access-manager
2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)
dnf --showduplicates list access-manager
sudo dnf downgrade access-manager-<VERSION_BEFORE_12.2.1.4.0>
sudo dnf versionlock add access-manager
Downgrade risk
Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.
After downgrade
Restart the service, and keep the package held until a fixed release ships.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Related CVEs
- CVE-2026-60726 HIGH 8.8 DOWNGRADE Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engi
- CVE-2026-70905 CRITICAL 9.8 DOWNGRADE Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Agent infrastructur