CVE-2026-73958 in Access Manager
Summary
by MITRE • 09/15/2026
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The identified vulnerability resides within the Authentication Engine component of Oracle Access Manager, a critical identity and access management solution included in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0. This security flaw represents a significant risk to organizational infrastructure because it allows an unauthenticated attacker with network access via HTTP to compromise the system. The severity of this issue is underscored by its CVSS v3.1 base score of 8.1, which classifies it as high severity due to substantial impacts on confidentiality, integrity, and availability. The specific vector indicates that while the attack complexity is relatively high, requiring certain conditions or timing to exploit successfully, no prior authentication or user interaction is necessary for a remote attacker to initiate the compromise.
From a technical perspective, this vulnerability likely stems from improper validation of input data or insufficient access control mechanisms within the authentication processing logic. Such flaws typically allow an adversary to bypass standard security checks, potentially leading to unauthorized administrative actions or session hijacking scenarios that result in full system takeover. The ability for an unauthenticated actor to gain control over Oracle Access Manager is particularly dangerous because this component serves as a gatekeeper for numerous enterprise applications and services. Compromising it effectively grants the attacker visibility into user identities, authentication states, and potentially sensitive data flows managed by the middleware platform.
The operational impact of exploiting this vulnerability extends far beyond the immediate compromise of the access manager itself. Since Oracle Access Manager often acts as a central point for single sign-on and policy enforcement across an organization's digital estate, gaining control over it can facilitate broader lateral movement within the network. An attacker could manipulate authentication policies to grant themselves elevated privileges, intercept sensitive credentials, or disrupt service availability by locking out legitimate users. This aligns with common attack patterns found in industry frameworks such as MITRE ATT&CK, specifically relating to initial access and privilege escalation techniques where identity-based controls are subverted to establish persistence or expand influence within the target environment.
Mitigation strategies must prioritize immediate patching of all affected Oracle Fusion Middleware instances to version 12.2.1.4.0 post-patch-set-update levels that address this specific flaw, or upgrading to a supported release where the issue is resolved in conjunction with other security hardening measures. In addition to applying vendor-provided patches, organizations should implement network-level controls such as web application firewalls to filter malicious HTTP requests targeting the authentication endpoints. Restricting direct internet-facing access to Oracle Access Manager components and ensuring that all administrative interfaces are protected by strong multi-factor authentication can further reduce the attack surface. Continuous monitoring for anomalous authentication attempts and regular vulnerability assessments are essential practices to detect potential exploitation activities early and maintain a robust security posture against evolving threats targeting identity management systems.