CVE-2026-73962 in Access Manager
Summary
by MITRE • 09/15/2026
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Access Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The identified vulnerability resides within the Authentication Engine component of Oracle Access Manager, a critical identity and access management solution that is part of the broader Oracle Fusion Middleware suite. This flaw affects specific supported versions including 12.2.1.4.0 and 14.1.2.1.0, representing significant deployments in enterprise environments where centralized authentication services are essential for operational continuity. The nature of this vulnerability allows a low-privileged attacker to exploit the weakness through network access via HTTPS, indicating that no local system privileges or user interaction such as clicking malicious links are required to initiate an attack vector. This remote exploitable characteristic significantly elevates the risk profile, as adversaries can target the service from any location with connectivity to the affected infrastructure without needing prior physical or logical proximity beyond standard network reachability.
The technical flaw enables a scope change during exploitation, meaning that while the initial point of compromise is Oracle Access Manager itself, the successful execution of an attack allows lateral movement and impact on additional products within the organization's ecosystem. This expansion of impact underscores the critical role Oracle Access Manager plays as a gatekeeper for various downstream applications and services. By compromising this central authentication hub, attackers can bypass security controls that rely on its validation mechanisms, effectively rendering perimeter defenses less effective against internal threats or those who have gained initial foothold through other means. The ability to alter the scope of impact transforms what might otherwise be an isolated service disruption into a widespread organizational compromise affecting multiple business-critical systems dependent on identity assertions issued by Oracle Access Manager.
Successful exploitation results in severe consequences for both data confidentiality and integrity, as reflected in the high CVSS 3.1 Base Score of 9.6. Attackers can achieve unauthorized creation, deletion, or modification access to critical data stored within or accessible through Oracle Access Manager. This capability allows for the manipulation of user identities, roles, policies, and session tokens, which are fundamental to maintaining secure access controls across an enterprise. Furthermore, attackers may gain complete access to all Oracle Access Manager accessible data, leading to extensive information disclosure. The high impact on confidentiality indicates that sensitive personal identifiable information, corporate secrets, or authentication credentials could be exfiltrated, while the high integrity impact suggests that malicious actors can alter security configurations to maintain persistent backdoor access or escalate privileges for other compromised accounts.
From a classification perspective, this vulnerability aligns with CWE-269 Improper Privilege Management and potentially CWE-798 Use of Hard-coded Credentials if authentication bypass is involved, though the specific technical root cause would require deeper code analysis. In terms of adversary behavior mapping to MITRE ATT&CK, this scenario corresponds to techniques such as T1078 Valid Accounts for initial access or persistence, and T1528 Steal Application Access Token if session hijacking occurs. The low attack complexity and lack of user interaction requirements place it in the category of high-severity remote code execution or privilege escalation vulnerabilities that require immediate attention due to their ease of exploitation by automated tools commonly used in widespread internet-based attacks.
Mitigation strategies must prioritize immediate patching to the latest available version provided by Oracle, which addresses the underlying flaw in the Authentication Engine logic. Organizations should also implement network segmentation to restrict HTTPS access to Oracle Access Manager components only from trusted application servers and management networks, thereby reducing the attack surface exposed to potential low-privileged attackers on broader subnets. Additionally, deploying Web Application Firewalls with specific rulesets designed to detect anomalous authentication requests or token manipulation attempts can provide a layer of defense in depth. Continuous monitoring for unusual patterns in access logs, such as rapid changes to user roles or unexpected creation of administrative accounts, is essential for early detection of exploitation attempts. Regular audits of identity policies and enforcement of least privilege principles across all integrated systems will help limit the blast radius should a compromise occur, ensuring that even if Oracle Access Manager is breached, the ability to impact downstream critical data remains constrained by robust secondary controls.