CVE-2026-73940: Oracle Access Manager Auth Bypass Flaw

CVE-2026-73940 Overview

CVE-2026-73940 is an authentication vulnerability in the Oracle Access Manager (OAM) component of Oracle Fusion Middleware. The flaw resides in the Authentication Engine and affects supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via the T3 or IIOP protocols can compromise Oracle Access Manager without user interaction. Successful exploitation results in full takeover of the OAM instance, impacting confidentiality, integrity, and availability. Oracle addressed the issue in Security Alert CSPUSEP2026. The weakness is classified as [CWE-287: Improper Authentication].

Critical Impact
Unauthenticated network attackers can take over Oracle Access Manager, gaining control of the enterprise authentication and single sign-on layer for downstream Fusion Middleware applications.

Affected Products

Oracle Fusion Middleware - Oracle Access Manager 12.2.1.4.0
Oracle Fusion Middleware - Oracle Access Manager 14.1.2.1.0
Deployments exposing T3 or IIOP protocol listeners to untrusted networks

Discovery Timeline

2026-09-15 - CVE-2026-73940 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-73940

Vulnerability Analysis

The vulnerability resides in the Authentication Engine of Oracle Access Manager, the component responsible for validating credentials and issuing session tokens for Fusion Middleware applications. Attackers reach the flaw through the T3 or Internet Inter-ORB Protocol (IIOP) remote invocation channels exposed by the underlying WebLogic Server. Because the flaw sits within authentication logic itself, exploitation does not require valid credentials or user interaction. A successful compromise yields full takeover of Oracle Access Manager, allowing the attacker to forge sessions, impersonate users, and pivot into any application relying on OAM for single sign-on. Oracle rated the confidentiality, integrity, and availability impact as high across all three dimensions.

Root Cause

The underlying weakness is classified as [CWE-287: Improper Authentication]. The Authentication Engine fails to correctly enforce identity verification for requests delivered over T3 and IIOP. Oracle has not published detailed root-cause internals in the public advisory, but the pattern is consistent with historical Fusion Middleware issues involving deserialization or protocol-level authentication handling in the WebLogic transport layer.

Attack Vector

Exploitation occurs over the network with low attack complexity and no privileges required. The attacker sends crafted T3 or IIOP requests to an exposed Oracle Access Manager listener. Because both protocols are frequently reachable on WebLogic administrative and managed server ports (default 7001 and 7002), any OAM deployment with those ports exposed beyond a trusted segment is directly reachable. The EPSS score at publication is 0.45% (percentile 38.2), indicating limited observed exploitation activity, though the impact profile makes the vulnerability a priority target for opportunistic scanning.

No public proof-of-concept code or verified exploit samples were available at the time of writing. Refer to the Oracle Security Alert CSPUSEP2026 for vendor technical details.

Detection Methods for CVE-2026-73940

Indicators of Compromise

Unexpected inbound connections to WebLogic T3 (7001) or IIOP (7002) ports from untrusted networks or geographies
New or unexplained OAM administrator sessions, session tokens issued without corresponding user login events, or forged OAM_ID cookies
Anomalous entries in oam_server.log, AdminServer.log, or access.log referencing authentication requests over T3/IIOP
Creation of new OAM system identity store entries, policy changes, or agent registrations outside change-management windows

Detection Strategies

Alert on T3 and IIOP traffic to Oracle Access Manager hosts that originates outside authorized administrative subnets
Correlate WebLogic authentication events with OAM session issuance to identify sessions created without a matching credential validation event
Baseline normal OAM administrative activity and flag deviations in policy, agent, or identity store modifications

Monitoring Recommendations

Forward WebLogic and OAM diagnostic, audit, and access logs to a centralized analytics platform for retention and correlation
Monitor network flow telemetry for T3/IIOP protocol usage across trust boundaries
Track process behavior on OAM servers for unexpected child processes spawned by the WebLogic Java process, which can indicate post-exploitation command execution

How to Mitigate CVE-2026-73940

Immediate Actions Required

Apply the patches referenced in Oracle Security Alert CSPUSEP2026 to affected 12.2.1.4.0 and 14.1.2.1.0 deployments
Restrict network exposure of WebLogic T3 and IIOP listeners to trusted administrative segments using firewall rules and WebLogic connection filters
Audit OAM configuration, agents, and identity stores for unauthorized changes since the affected versions were deployed
Rotate OAM administrative credentials and any long-lived session or trust artifacts following patching

Patch Information

Oracle released fixes as part of Security Alert CSPUSEP2026. Administrators should apply the update to Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 following the deployment guidance in the advisory. Confirm the patch level with opatch lsinventory after installation and restart WebLogic managed servers to load the updated binaries.

Workarounds

Configure WebLogic Connection Filters (weblogic.security.net.ConnectionFilterImpl) to deny T3 and IIOP traffic from untrusted source addresses when patching cannot occur immediately
Disable IIOP on managed servers where it is not required for application functionality
Place Oracle Access Manager behind a reverse proxy or web application firewall that only exposes required HTTP(S) authentication endpoints
Enforce strict network segmentation between OAM infrastructure and general user or internet-facing networks

bash

# Example WebLogic connection filter rule to restrict T3/IIOP to trusted subnet
# Set in WebLogic Console: Environment > Domain > Security > Filter
# Class Name: weblogic.security.net.ConnectionFilterImpl
10.0.0.0/8   * * allow t3 t3s iiop iiops
0.0.0.0/0    * * deny  t3 t3s iiop iiops