CVE-2026-73958: High severity Oracle Oracle Access Manager vulnerability
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Oracle Access Manager Authentication Engine deployments running supported versions 12.2.1.4.0 or 14.1.2.0.0 are affected.
Does an attacker need an account or user interaction to exploit this issue?
No. The vulnerability can be exploited by an unauthenticated attacker and does not require user interaction, provided the attacker has network access to the target over HTTP.
How serious is a successful compromise?
A successful attack can result in takeover of Oracle Access Manager, with high impact to confidentiality, integrity, and availability.
Is exploitation expected to be straightforward?
No. The vulnerability is rated high attack complexity and described as difficult to exploit, although it remains remotely reachable over HTTP.