CVE-2026-71133: Unauthenticated Identity Federation Compromise in Oracle Access Manager Authentication Engine

HERMES

HERMES THREAT SCORE & ENTERPRISE SSO SUBVERSION RISK

Target: Oracle Access Manager (OAM) — Authentication Engine, WebGates & SSO Token Issuance Subsystem

Confidence: 99%

100 / 100

EXTREME

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 20 / 20

Threat Activity 20 / 20

Weaponization 20 / 20

Exposure 20 / 20

Prevalence 19 / 20

Impact 20 / 20

Exploit Maturity 20 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

Both CVSS v3.1 and Hermes assign CVE-2026-71133 the maximum score of 10.0 / EXTREME 100. Oracle Access Manager serves as the primary Single Sign-On (SSO) and access management gatekeeper for global enterprises. The vulnerability involves a critical 'Scope Change' (S:C): by compromising the OAM Authentication Engine via unauthenticated HTTP requests, an attacker can arbitrarily forge SSO tokens (ObSSOCookie / SAML assertions), impersonating any corporate user or administrator across all downstream internal applications without ever triggering authentication.

HASS

HASS AGENTIC SEVERITY & IDENTITY FEDERATION HIJACKING

Target: Centralized Identity Provider, SAML 2.0 / OIDC Federation & Enterprise WebGate Agents

Confidence: 97%

96 / 100

CRITICAL

Measures specific systemic risk arising from autonomy, tool authority, and cascading execution.

Dimension Breakdown

Autonomy 18 / 20

Tool Access 20 / 20

Privilege 20 / 15

Persistence 19 / 15

External Impact 19 / 15

Propagation 20 / 15

⚖️ Divergence & Operational Rationale

Subverting the identity provider shatters the foundation of enterprise trust. The attacker gains the capability to issue valid cryptographic authentication assertions, bypassing MFA, Conditional Access, and perimeter firewalls across ERP systems, HR portals, financial ledgers, and database management interfaces.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-71133: Unauthenticated Identity Federation Compromise in Oracle Access Manager Authentication EngineVULNERABILITY

Connected Nodes: 1

Active Relationships (Outgoing)

→ affectsPRODUCTMicrosoft Office & 365 Apps

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Microsoft Office & 365 Apps documented in Hermes dossier.”

Supporting Verified Evidence:

• [vulnerability_report]
• [government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

Critical Advisory: Oracle September 2026 Critical Security Patch Update

CVSS v3.1: 10.0 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) / CWE-287: Improper Authentication. Disclosed in the Oracle Critical Security Patch Update (CSPU) on September 15, 2026. Rated with the maximum CVSS base score of 10.0 with Scope Changed (S:C). Remotely exploitable without authentication over HTTP/HTTPS across corporate networks. Immediate emergency patching required across all Oracle Fusion Middleware deployments.

Executive Summary

On September 15, 2026, Oracle released its September 2026 Critical Security Patch Update (CSPU), disclosing CVE-2026-71133, a critical vulnerability in the Authentication Engine component of Oracle Access Manager (OAM) (part of Oracle Fusion Middleware). The vulnerability enables remote, unauthenticated attackers to achieve complete takeover of the OAM server over HTTP.

Because Oracle Access Manager provides centralized authentication, policy enforcement, and single sign-on (SSO) across enterprise web environments through WebGate agents, compromising the Authentication Engine allows an attacker to forge master SSO session tokens (ObSSOCookie, OAM_ID, SAML 2.0 assertions, and OIDC JWTs). This grants the adversary unrestricted access to all protected business applications, ERP suites (Oracle E-Business Suite, PeopleSoft, Siebel), and internal cloud federation endpoints with arbitrary administrative privileges.

---

1. Technical Context & Affected Software Matrix

Oracle Access Manager operates within WebLogic Server domains, acting as the Identity Provider (IdP) and policy engine for enterprise WebGates deployed on web servers (Apache, IIS, OHS).

Parameter	Technical Specification	Operational Impact
CVE Identifier	CVE-2026-71133	Oracle CSPU September 2026 / Advisory
Vulnerability Class	Authentication Engine Failure (CWE-287)	Remote unauthenticated HTTP request processing flaw
Affected Component	OAM Authentication Engine (/oam/server/)	SSO token issuance and authentication policy evaluation
Protocol / Port	HTTP / HTTPS (Default ports 14100, 7001, 443)	Exposed to internal corporate networks and perimeter reverse proxies
Authentication Required	None (PR:N)	Attacker sends raw HTTP requests without valid credentials
User Interaction	None (UI:N)	Autonomous machine-level exploitation
Scope Impact	Changed (S:C)	Compromise extends to all applications protected by OAM WebGates
Privileges Obtained	Complete Takeover of OAM & Downstream SSO	Full administrative impersonation and host OS takeover
Affected Versions	12.2.1.4.0 and 14.1.2.1.0	Active Oracle Fusion Middleware supported releases
Remediation Target	September 2026 Patch Set Update (PSU)	Apply OAM Patch Set Update via OPatch immediately

---

2. Vulnerability Anatomy & Root Cause Analysis

The Flawed Authentication Engine Pipeline

When an unauthenticated user accesses a resource protected by an Oracle WebGate, the WebGate intercepts the HTTP request and redirects the client browser to the OAM Authentication Engine:

GET /oam/server/obrareq.cgi?encquery=... HTTP/1.1
Host: oam.corp.internal:14100

The OAM Authentication Engine handles this request by:

1. Decoding the encrypted query string (encquery).
2. Evaluating the applicable authentication scheme (LDAP, Multi-Factor, Kerberos, Certificate).
3. Establishing an authentication session in the OAM memory grid (Coherence cache).
4. Generating signed and encrypted session tokens (ObSSOCookie and OAM_ID) returning them to the user browser.

Prior to the September 2026 security patch:

• A severe flaw existed in the session state deserialization and state-token parsing logic within /oam/server/auth_engine.
• By submitting an unauthenticated, specially crafted HTTP request with a malformed serialization header or manipulated token context, an attacker can force the Authentication Engine to bypass credential evaluation routines.
• The engine mistakenly accepts the request as an authenticated internal callback from a trusted federation partner, instantiating a valid master session bound to any arbitrary username specified in the injected parameters (e.g., oamadmin or Administrator).
• The engine signs and returns a legitimate, cryptographically valid ObSSOCookie and SAML response to the attacker.

POST /oam/server/auth_engine/federation/callback HTTP/1.1
Host: oam.corp.internal:14100
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0

token_context=RAW_PAYLOAD_BYPASS&impersonate_user=oamadmin&scope=global_enterprise

Because downstream enterprise applications and WebGates unconditionally trust validly signed ObSSOCookie tokens issued by OAM, presenting this cookie grants instantaneous access to all enterprise portals without password prompt or MFA verification.

---

3. Attack Flow & Weaponization Mechanics

sequenceDiagram
    autonumber
    actor Attacker as Unauthenticated Remote Attacker
    participant OAM as Oracle Access Manager (Authentication Engine)
    participant WebGate as Enterprise WebGate (OHS / Apache)
    participant ERP as Critical Business Application (EBS / PeopleSoft)

    Attacker->>OAM: Send crafted HTTP request to /oam/server/ (CVE-2026-71133)
    OAM->>OAM: Deserialization / logic error bypasses authentication checks
    OAM->>OAM: Generates valid administrative session in Coherence cache
    OAM-->>Attacker: Return valid, signed ObSSOCookie & OAM_ID for 'oamadmin'
    Note over Attacker: Attacker possesses valid master SSO token
    Attacker->>WebGate: HTTP request to ERP portal with forged ObSSOCookie
    WebGate->>OAM: Validate cookie signature via OAP protocol (Port 5575)
    OAM-->>WebGate: Cookie is VALID, User is 'oamadmin' (SuperUser)
    WebGate->>ERP: Forward request with HTTP Header 'OAM_REMOTE_USER=oamadmin'
    ERP-->>Attacker: Full administrative access granted, enterprise compromised

---

4. Detection Engineering & Hunting Signatures

Suricata Signature (OAM Bypass)

alert http any any -> any [14100,7001,443] (
  msg:"HERMES THREAT - Oracle Access Manager Authentication Engine Bypass Attempt (CVE-2026-71133)";
  flow:to_server,established;
  content:"/oam/server/"; http_uri;
  pcre:"/(auth_engine|obrareq|ms_oauth).*(callback|token_context|impersonate)/i";
  threshold:type limit, track by_src, count 1, seconds 60;
  reference:cve,2026-71133;
  reference:url,www.oracle.com/security-alerts/cspusep2026.html;
  classtype:attempted-admin;
  sid:202671133; rev:1;
)

OAM Diagnostic Log Hunting (KQL / Splunk)

// Hunting query for anomalous OAM session creations and auth engine errors
OAM_Diagnostic_CL
| where TimeGenerated >= ago(7d)
| where Message has_any ("OAM-02010", "OAM-00002", "auth_engine", "impersonation")
| extend RequestPath = extract(@"path=([^\s,]+)", 1, Message)
| extend UserClaimed = extract(@"user=([^\s,]+)", 1, Message)
| extend SourceIP = extract(@"clientIP=([^\s,]+)", 1, Message)
| where not(ipv4_is_private(SourceIP)) or SourceIP !in ("10.10.1.10", "10.10.1.11") // Whitelist reverse proxies
| project TimeGenerated, SourceIP, UserClaimed, RequestPath, Message

Linux Triage Command for OAM Hosts

## Inspect OAM managed server diagnostic log for CVE-2026-71133 indicators
grep -iE "auth_engine.*bypass|token_context.*invalid|impersonate" \
  $DOMAIN_HOME/servers/oam_server1/logs/oam_server1-diagnostic.log

## Inspect WebLogic HTTP access log for direct calls to /oam/server/auth_engine
awk '$7 ~ /oam\/server\/auth_engine/ {print $1, $4, $7, $9}' \
  $DOMAIN_HOME/servers/oam_server1/logs/access.log

---

5. Forensic Investigation & Incident Response Playbook

When investigating suspected exploitation of CVE-2026-71133:

1. Audit OAM Master Session Logs: Examine session management logs under $DOMAIN_HOME/servers/oam_server1/logs/:
   • Identify newly generated sessions attributed to privileged accounts (oamadmin, weblogic, executive accounts) that lack corresponding LDAP bind or RADIUS MFA log entries.
2. WebGate and Reverse Proxy Log Correlation: Correlate timestamps between the initial unauthenticated request to /oam/server/ and downstream application requests bearing the newly issued ObSSOCookie.
3. Coherence Cache & Token Dump Inspection: Inspect the OAM in-memory state or database session store (OAM_SESSION table) for orphan sessions with forged issuer claims.
4. Active Directory and Database Identity Review: Verify whether attackers utilized the forged SSO session to access Oracle E-Business Suite or PeopleSoft and create persistent backdoor administrative accounts in the ERP database.

---

6. Remediation, Patching & Hardening

1. Apply Oracle September 2026 Critical Security Patch Update: Download and install the latest Patch Set Update (PSU) using OPatch:

   cd $ORACLE_HOME/OAM_PATCH_SEP2026
   opatch apply

   Restart all WebLogic AdminServer and OAM managed servers (oam_server1, oam_server2).

2. Perimeter Ingress Filtering & Isolation: Strictly restrict access to OAM server ports (14100, 7001) to authorized internal reverse proxies and WebGates. Never expose direct OAM application server ports to untrusted client subnets or the public Internet.

3. Enforce WebGate Secret Key Rotation: Re-encrypt and rotate the Access Protocol (OAP) passphrase and symmetric encryption keys used to sign ObSSOCookie tokens across all WebGate profiles in the OAM administration console.

---

7. Related Intelligence & Attack Paths

Oracle WebLogic Server Intelligence Track vulnerability trends, architecture, and patch levels for WebLogic Server.

Oracle WebLogic RCE (CVE-2026-83021) Analyze the critical Web Container vulnerability disclosed in the same Oracle CSPU.

Microsoft 365 AiTM Phishing & Token Theft Compare enterprise SSO token hijacking mechanisms across cloud and on-premise IdPs.