CVE-2026-73950 in Access Manager
Summary
by MITRE • 09/15/2026
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The identified vulnerability resides within the Authentication Engine component of Oracle Access Manager, a critical identity governance solution included in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0. This security flaw represents a severe risk to organizational infrastructure because it allows for remote code execution or complete system compromise without requiring any form of user authentication. The vulnerability is classified as easily exploitable, meaning that an attacker does not need specialized skills or complex conditions to leverage this weakness. Instead, the primary requirement for exploitation is network access via HTTP, which significantly broadens the attack surface by allowing adversaries located on adjacent networks or even across public internet connections if the service is exposed improperly to execute malicious payloads against the target system.
From a technical perspective, the flaw likely stems from insufficient input validation or improper handling of authentication requests within the core engine logic. Because the vulnerability permits unauthenticated access, it bypasses standard security controls designed to verify user identity before processing sensitive operations. This absence of proper authorization checks enables an attacker to interact directly with internal APIs or administrative interfaces that should be restricted. The ability to compromise Oracle Access Manager in this manner is particularly dangerous because this product serves as a central hub for managing identities and access policies across enterprise environments. By taking over the authentication engine, an adversary effectively gains control over the gatekeeper of digital resources, allowing them to manipulate who has access to what systems within the organization.
The operational impact of successfully exploiting this vulnerability is catastrophic, reflected in its high severity rating with a CVSS 3.1 Base Score of 9.8 out of 10. This score indicates that the vulnerability affects all three pillars of the CIA triad: Confidentiality, Integrity, and Availability. An attacker who compromises Oracle Access Manager can extract sensitive user credentials and identity data, leading to significant confidentiality breaches. Furthermore, they can alter access policies or impersonate legitimate users, resulting in a complete loss of integrity within the identity management framework. Additionally, the ability to disrupt authentication services can lead to denial-of-service conditions, halting business operations that rely on secure login mechanisms. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H underscores that while the scope remains unchanged (S:U), the impact on individual components is high across all metrics due to the lack of required privileges and user interaction.
In terms of industry standard classifications, this vulnerability aligns with CWE-287 Improper Authentication and CWE-306 Missing Authentication for Critical Function within the Common Weakness Enumeration framework. These categories highlight the fundamental failure in verifying identity before granting access to critical system functions. From a tactical standpoint, exploitation techniques associated with such vulnerabilities often map to MITRE ATT&CK technique T1078 Valid Accounts or T1190 Exploit Public-Facing Application, depending on whether the attacker uses stolen credentials or purely exploits the code flaw without prior compromise of user accounts. The ease of exploitation and network accessibility make this a prime target for automated scanning tools used by threat actors seeking to establish an initial foothold in enterprise networks.
To mitigate this risk, organizations running affected versions must immediately apply the latest security patches provided by Oracle. It is imperative to verify that all instances of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 are updated to a version where this authentication engine flaw has been remediated. In environments where patching cannot be implemented instantly, temporary mitigations should include restricting network access to the Authentication Engine components using firewall rules or reverse proxy configurations that enforce strict IP whitelisting for administrative interfaces. Additionally, deploying Web Application Firewalls with specific rule sets designed to detect and block anomalous authentication requests can provide an additional layer of defense against exploitation attempts while permanent fixes are being deployed across the infrastructure.