CVE-2026-73947 in Access Manager
Summary
by MITRE • 09/15/2026
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The identified vulnerability resides within the Authentication Engine component of Oracle Access Manager, a critical identity and access management solution included in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0. This security flaw represents a severe risk to organizational infrastructure because it allows for remote code execution or complete system compromise without requiring any form of user authentication. The vulnerability is classified as easily exploitable, meaning that an attacker does not need specialized skills or complex conditions to leverage this weakness against the target system.
From a technical perspective, the core issue lies in how the Authentication Engine processes incoming requests over HTTP. Because the flaw permits unauthenticated access, it effectively bypasses the fundamental security controls designed to verify user identity before granting access to sensitive administrative functions or internal services. This lack of proper input validation and authentication enforcement creates an open door for malicious actors operating from a network location that can reach the Oracle Access Manager instance. The attacker interacts with the service via standard HTTP protocols, which are ubiquitous and often permitted through firewalls, making detection and prevention more challenging without specific security monitoring rules.
The operational impact of this vulnerability is catastrophic due to its high severity rating. With a CVSS 3.1 Base Score of 9.8 out of 10, the flaw impacts all three pillars of information security: confidentiality, integrity, and availability. A successful exploitation allows an unauthenticated attacker to take full control of the Oracle Access Manager instance. This takeover enables the adversary to manipulate authentication policies, potentially granting themselves or other unauthorized users administrative privileges across the entire identity management ecosystem. Consequently, attackers can access sensitive user data, alter authorization rules to bypass security controls for other applications, and disrupt service availability by locking out legitimate users or disabling critical security features.
This vulnerability aligns with Common Weakness Enumeration (CWE) categories such as CWE-287 Improper Authentication and CWE-306 Missing Authentication for Critical Function. In the context of the MITRE ATT&CK framework, this flaw facilitates initial access techniques where an attacker exploits a service to gain entry into the network environment. Once inside, the ability to take over Oracle Access Manager allows for lateral movement and privilege escalation across connected systems that rely on this central identity provider for authentication decisions. The lack of required user interaction further classifies it under remote code execution vectors that do not depend on social engineering or client-side exploitation.
Mitigation strategies must focus immediately on restricting network access to the vulnerable components until a patch is applied. Organizations should ensure that Oracle Access Manager instances are not exposed directly to untrusted networks such as the public internet. Implementing strict firewall rules to limit HTTP and HTTPS traffic to only known, trusted IP addresses or internal subnets can significantly reduce the attack surface. Additionally, deploying Web Application Firewalls with specific signatures for this vulnerability can help detect and block exploitation attempts in real-time. It is imperative that administrators apply the latest security patches provided by Oracle as soon as they become available, ensuring that all supported versions are updated to address these critical authentication flaws. Regular audits of access control configurations and monitoring for anomalous administrative activity will also aid in identifying any potential compromise resulting from this vulnerability.