CVE-2026-73941: Oracle Access Manager Auth Bypass Vulnerability

CVE-2026-73941 Overview

CVE-2026-73941 is an access control weakness in the Authentication Engine of Oracle Access Manager, a component of Oracle Fusion Middleware. The flaw allows an unauthenticated remote attacker with HTTP network access to compromise Oracle Access Manager and reach data belonging to other products through a scope change. The weakness is classified under CWE-284: Improper Access Control and affects supported versions 12.2.1.4.0 and 14.1.2.1.0. Oracle addressed the issue in its September 2026 security alert.

Critical Impact
An unauthenticated attacker can gain unauthorized access to critical data across Oracle Access Manager and, due to scope change, additional Oracle Fusion Middleware products.

Affected Products

Oracle Access Manager 12.2.1.4.0
Oracle Access Manager 14.1.2.1.0
Oracle Fusion Middleware components integrated with the Authentication Engine

Discovery Timeline

2026-09-15 - CVE-2026-73941 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-73941

Vulnerability Analysis

The Authentication Engine in Oracle Access Manager fails to properly enforce access controls on HTTP requests. An unauthenticated attacker can send crafted requests over the network without user interaction and read confidential data. The vulnerability produces a scope change, meaning impact extends beyond Oracle Access Manager itself to other products that trust its authentication decisions.

The confidentiality impact is high while integrity and availability are not affected. Attackers focused on identity infrastructure can leverage exposed data—session tokens, user attributes, or federation metadata—to pivot into downstream applications that rely on Oracle Access Manager for single sign-on. The Oracle Security Alert provides Oracle's authoritative technical guidance.

EPSS currently estimates exploitation probability at 0.316%, placing the flaw in the 24.5th percentile of published vulnerabilities.

Root Cause

The root cause is improper access control ([CWE-284]) within the Authentication Engine. The component does not consistently validate authorization before releasing protected data through HTTP endpoints. Oracle has not published detailed root-cause code paths in the public alert.

Attack Vector

Exploitation requires only network access to the Oracle Access Manager HTTP interface. No authentication, no privileges, and no user interaction are required. Attack complexity is low, making the flaw practical for opportunistic scanning against exposed identity management endpoints.

No public proof-of-concept code or exploit is currently available. Refer to Oracle's advisory for authoritative technical details rather than any third-party reconstructions.

Detection Methods for CVE-2026-73941

Indicators of Compromise

Unauthenticated HTTP requests to Oracle Access Manager endpoints returning sensitive payloads or user attribute data
Anomalous outbound data volumes from Oracle Access Manager hosts to untrusted IP addresses
Access log entries for authentication endpoints originating from unknown or geographically unusual sources

Detection Strategies

Baseline normal HTTP request patterns to Oracle Access Manager and alert on unusual URI or parameter combinations
Correlate web server access logs with authentication events to identify requests that return protected data without a valid session
Deploy web application firewall rules that inspect requests to /oam/, /oamsso/, and related Authentication Engine paths

Monitoring Recommendations

Forward Oracle Access Manager access and audit logs to a centralized SIEM for correlation
Monitor for spikes in HTTP 200 responses from unauthenticated sources against Authentication Engine URIs
Track federation and SSO token issuance for anomalies that suggest reuse of leaked session material

How to Mitigate CVE-2026-73941

Immediate Actions Required

Apply the fixes from Oracle's September 2026 Critical Patch Update on all Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 deployments
Restrict network exposure of Oracle Access Manager administrative and Authentication Engine endpoints to trusted networks
Review authentication and access logs for signs of unauthorized data retrieval since the vulnerable versions were deployed

Patch Information

Oracle published fixes in the Oracle Security Alert for September 2026. Administrators should download and apply the patches referenced in that alert for the affected Oracle Access Manager versions. Oracle recommends applying Critical Patch Updates without delay.

Workarounds

Place Oracle Access Manager behind a reverse proxy or web application firewall that enforces strict URL and parameter allow-lists
Limit inbound HTTP traffic to Oracle Access Manager to known application segments using network ACLs
Rotate SSO signing keys and session material after patching if unauthorized access is suspected

bash

# Example: restrict Oracle Access Manager HTTP access with iptables
iptables -A INPUT -p tcp --dport 14100 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 14100 -j DROP