In Access Manager Patch 1 for Windows, the Access Manager classpath is not pointing to the patched version of the xmlsec.jar.
Workaround
Copy jes-install-dir\identity\lib\xmlsec.jar to jes-install-dir\share\lib\xmlsec.jar.