CVE-2026-73926: Oracle Access Manager Auth Bypass Flaw

CVE-2026-73926 Overview

CVE-2026-73926 is an improper access control vulnerability [CWE-284] in the Authentication Engine component of Oracle Access Manager, part of Oracle Fusion Middleware. Affected releases include versions 12.2.1.4.0 and 14.1.2.1.0. An authenticated attacker with high privileges and network access over HTTP can compromise the product. The flaw carries a scope change, meaning successful exploitation can impact resources beyond Oracle Access Manager itself. Oracle disclosed the issue in the Oracle Security Alert CSPUSEP2026 advisory.

Critical Impact
Successful exploitation grants unauthorized creation, deletion, or modification of critical data and full read access to all data accessible through Oracle Access Manager, with impact potentially extending to additional integrated products.

Affected Products

Oracle Access Manager 12.2.1.4.0
Oracle Access Manager 14.1.2.1.0
Oracle Fusion Middleware deployments using the Authentication Engine component

Discovery Timeline

2026-09-15 - CVE-2026-73926 published to NVD
2026-09-16 - Last updated in NVD database
Oracle Security Alert CSPUSEP2026 published by Oracle

Technical Details for CVE-2026-73926

Vulnerability Analysis

CVE-2026-73926 resides in the Authentication Engine of Oracle Access Manager (OAM), a component responsible for validating credentials and enforcing authentication policies across federated Oracle applications. The vulnerability is classified as improper access control [CWE-284], indicating that the engine fails to correctly enforce authorization boundaries for privileged operations exposed over HTTP.

An attacker who already holds high-level privileges within the environment can invoke functionality that should be restricted. Because OAM issues session tokens and authorization decisions consumed by downstream applications, the flaw produces a scope change. Compromise of the authentication engine can cascade into integrated services that trust OAM assertions.

Exploitation does not require user interaction and is described by Oracle as easily exploitable. The attack impacts confidentiality and integrity of data accessible through OAM, but does not affect availability.

Root Cause

The root cause is insufficient enforcement of access controls within the Authentication Engine. Requests that should be validated against the acting principal's privileges are processed without adequate authorization checks, allowing a privileged actor to reach protected functionality outside their intended scope.

Attack Vector

The attack vector is network-based over HTTP. An attacker authenticates with high privileges to an OAM administrative or service interface, then issues crafted requests to the Authentication Engine. Successful requests yield read and write access to OAM-managed data and can influence authentication outcomes for federated applications. Refer to the Oracle Security Alert CSPUSEP2026 for vendor guidance.

Detection Methods for CVE-2026-73926

Indicators of Compromise

Unexpected creation, modification, or deletion of OAM policy objects, identity stores, or authentication schemes
Administrative HTTP requests to the Authentication Engine originating from accounts that do not normally perform configuration changes
Anomalous session token issuance patterns or authorization decisions for downstream Fusion Middleware applications

Detection Strategies

Review OAM audit logs for privileged operations that do not correlate with approved change tickets
Correlate OAM administrative activity with downstream application access to identify scope-change abuse
Alert on configuration changes to authentication modules, plug-ins, or policy stores outside of maintenance windows

Monitoring Recommendations

Forward OAM audit and access logs to a centralized SIEM for retention and correlation with identity events
Baseline normal administrator behavior and generate alerts for deviations such as off-hours logins or unusual source addresses
Monitor Oracle Fusion Middleware WebLogic access logs for HTTP requests targeting Authentication Engine endpoints

How to Mitigate CVE-2026-73926

Immediate Actions Required

Apply the patches referenced in Oracle Security Alert CSPUSEP2026 to affected 12.2.1.4.0 and 14.1.2.1.0 deployments
Inventory Oracle Access Manager instances and confirm patch status through configuration management
Rotate credentials for privileged OAM administrative accounts as a precaution

Patch Information

Oracle addresses CVE-2026-73926 in the security fixes distributed with the Oracle Security Alert CSPUSEP2026. Administrators should review the advisory for the specific patch bundles applicable to their Fusion Middleware release and follow Oracle's standard patch application procedure for OAM.

Workarounds

Restrict network access to OAM administrative endpoints using firewall rules or reverse proxy allowlists
Enforce least privilege for OAM administrator roles and remove unused high-privilege accounts
Require multi-factor authentication for all OAM administrative sessions to raise the bar for attackers with stolen credentials