CVE-2026-73944 in Access Manager
Summary
by MITRE • 09/15/2026
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Access Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The identified vulnerability resides within the Authentication Engine component of Oracle Access Manager, a critical identity governance solution included in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0. This security flaw represents a significant risk to organizational infrastructure as it allows for remote code execution or unauthorized state manipulation without requiring prior authentication credentials. The vulnerability is classified under the network attack vector, indicating that an attacker can exploit this weakness from across a network boundary, such as the internet or an internal corporate LAN, provided they have connectivity via HTTP protocols. This accessibility makes the flaw particularly dangerous in environments where Oracle Access Manager serves as the primary gateway for user authentication and access control to downstream applications and services.
The technical nature of this vulnerability centers on insufficient validation or improper handling of input data within the Authentication Engine logic. While specific exploit code details are not provided, the high severity score suggests that an unauthenticated attacker can send specially crafted HTTP requests to trigger a state change in the application server. This could involve manipulating session tokens, bypassing authentication checks through parameter tampering, or exploiting deserialization flaws if applicable. The lack of required user interaction and low complexity further implies that automated scanning tools or script-based attackers can reliably reproduce this condition against vulnerable instances without needing social engineering tactics to trick a legitimate user into performing an action.
The operational impact of successfully exploiting this vulnerability is severe, encompassing both confidentiality and integrity breaches as reflected in the CVSS 3.1 base score of 9.1. An attacker who gains access through this flaw can create, delete, or modify critical data within Oracle Access Manager itself. This includes altering user roles, permissions, and policy configurations that dictate how other systems are accessed. Consequently, the integrity of the entire identity management framework is compromised. Furthermore, because Oracle Access Manager often acts as a single point of entry for numerous enterprise applications, compromising it grants the attacker unauthorized access to all data protected by these downstream services. This effectively results in complete access to sensitive corporate information, including personally identifiable information, financial records, and intellectual property, leading to potential regulatory violations and significant reputational damage.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication or CWE-306 Missing Authentication for Critical Function depending on the specific mechanism exploited within the engine. In terms of offensive security frameworks such as MITRE ATT&CK, this behavior corresponds to techniques involving Initial Access via valid accounts if session hijacking is involved, or more likely T1190 Exploit Public-Facing Application when leveraging unauthenticated remote code execution paths. The attack path typically involves reconnaissance followed by exploitation of the web application interface to gain a foothold within the network perimeter, potentially serving as an entry point for lateral movement toward higher-value targets like domain controllers or database servers if Oracle Access Manager is integrated with Active Directory or similar identity providers.
Mitigation strategies must be implemented immediately given the high severity and unauthenticated nature of the exploit. The primary remediation step is to apply the latest security patches provided by Oracle for the affected versions 12.2.1.4.0 and 14.1.2.1.0, ensuring that all components including the Authentication Engine are updated to their most recent patch set levels. Organizations should also verify whether any public-facing instances of Oracle Access Manager exist on networks accessible from untrusted zones such as the internet; if so, these services must be restricted or removed until patched. Network-level controls can provide temporary relief by implementing Web Application Firewalls configured with rulesets specifically designed to detect and block exploitation attempts against known vulnerabilities in Oracle Fusion Middleware components. Additionally, strict access control lists should restrict HTTP traffic to only authorized management IPs during the patching window to minimize exposure. Regular vulnerability scanning and penetration testing of identity infrastructure are recommended to ensure no similar misconfigurations or unpatched flaws remain within the environment.