Two CVE records published on 16 September 2026 (AWST) rate CVE-2026-71133 and CVE-2026-83059 at CVSS 3.1 10.0, critical. CVE-2026-71133 is in the Authentication Engine component of Oracle Access Manager (Oracle Fusion Middleware): the record says the easily exploitable vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager, and a successful attack can result in takeover of Oracle Access Manager.

CVE-2026-83059 is in the OID LDAP Server component of Oracle Internet Directory: the same kind of unauthenticated network attack, via LDAP, can result in takeover of Oracle Internet Directory. For both, the records say attacks may significantly impact additional products (scope change), and list supported versions 12.2.1.4.0 and 14.1.2.1.0 as affected. (source: CVE records)

Correction (31 Oct 2026): removed Oracle's Critical Security Patch Update advisory and SecurityWeek, which this desk cannot read, as sources, with the details only they gave; the card now carries only what the two CVE records state, and its date moved from 15 to 16 September 2026, the records' publication date in AWST. (source: CVE records)