CVE-2026-73940: Critical severity Oracle Oracle Access Manager vulnerability
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this vulnerability?
Oracle Access Manager deployments using the Authentication Engine in supported versions 12.2.1.4.0 or 14.1.2.1.0 are affected when they are reachable over T3 or IIOP.
Does exploitation require an account or user interaction?
No. An unauthenticated attacker with network access via T3 or IIOP can exploit the vulnerability, and no user interaction is required.
What could a successful attack allow an attacker to do?
Successful exploitation can result in takeover of Oracle Access Manager, with high impact to confidentiality, integrity, and availability.