CVE-2026-73944: Oracle Access Manager Auth Bypass Flaw

CVE-2026-73944 Overview

CVE-2026-73944 is an authentication flaw in the Authentication Engine component of Oracle Access Manager, part of Oracle Fusion Middleware. Affected releases include versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated remote attacker can compromise the product over HTTP without user interaction. Successful exploitation grants unauthorized read, create, modify, or delete access to all data reachable by Oracle Access Manager. The weakness maps to Improper Authentication [CWE-287]. Oracle disclosed the issue in its September 2026 Critical Patch Update Security Alert.

Critical Impact
Unauthenticated network attackers can gain full read and write access to data managed by Oracle Access Manager, undermining the security controls that downstream applications rely on for single sign-on and access enforcement.

Affected Products

Oracle Fusion Middleware — Oracle Access Manager 12.2.1.4.0
Oracle Fusion Middleware — Oracle Access Manager 14.1.2.1.0
Authentication Engine component

Discovery Timeline

2026-09-15 - CVE-2026-73944 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-73944

Vulnerability Analysis

The vulnerability resides in the Authentication Engine of Oracle Access Manager (OAM), the module responsible for validating user credentials and issuing session tokens for downstream Fusion Middleware applications. An unauthenticated attacker with HTTP network reach can bypass authentication controls to access or modify data protected by OAM. Because OAM commonly fronts business-critical applications, exposure extends beyond the product itself to any resource protected by its policies. The confidentiality and integrity impacts are high, while availability is not directly affected. Oracle classifies the flaw as easily exploitable, meaning no specialized conditions or victim interaction are required.

Root Cause

The issue is categorized under Improper Authentication [CWE-287]. The Authentication Engine fails to correctly validate the identity claim of an incoming HTTP request, allowing an attacker to reach protected functionality without valid credentials. Oracle's advisory does not disclose the specific parsing or verification defect. The EPSS score is 0.308% at the 23.5 percentile as of 2026-09-16.

Attack Vector

Exploitation occurs over the network using HTTP requests directed at the OAM endpoint. No prior authentication, elevated privileges, or user interaction are required. An attacker with reachability to the OAM authentication interface can craft requests that trigger the bypass and then perform unauthorized read or write operations against OAM-accessible data. Deployments that expose OAM to untrusted networks face the highest risk.

See the Oracle Security Alert for vendor-provided technical detail.

Detection Methods for CVE-2026-73944

Indicators of Compromise

Unexpected authentication successes in OAM audit logs without matching credential submission events.
Creation, modification, or deletion of OAM policy, user, or session records outside of change-management windows.
HTTP requests to OAM authentication endpoints originating from unusual source IPs, user agents, or geographies.
Session tokens issued for administrative or privileged principals without a corresponding interactive login trail.

Detection Strategies

Correlate OAM access logs with upstream web-server logs to identify authenticated sessions that lack a preceding valid credential exchange.
Baseline normal API and admin activity against the Authentication Engine, and alert on deviations in request volume, path, or parameter shape.
Inspect HTTP request bodies to OAM authentication endpoints for anomalous or malformed parameters that may indicate bypass attempts.

Monitoring Recommendations

Forward OAM audit, access, and admin logs to a centralized SIEM or data lake for retention and correlation.
Enable alerting on privileged operations within OAM, including policy edits, identity store changes, and agent registrations.
Monitor network telemetry for direct external access to OAM management interfaces that should be internal only.

How to Mitigate CVE-2026-73944

Immediate Actions Required

Apply the fixes from the September 2026 Oracle Critical Patch Update Security Alert to all affected OAM deployments.
Inventory every Oracle Access Manager instance at versions 12.2.1.4.0 and 14.1.2.1.0 and prioritize internet-facing systems.
Rotate administrative credentials, OAuth clients, and agent secrets managed through OAM after patching, in case of prior compromise.
Review OAM audit trails for the period preceding patch deployment to identify suspicious authentication or policy changes.

Patch Information

Oracle addressed CVE-2026-73944 in its September 2026 Critical Patch Update Security Alert. Administrators should consult the Oracle Security Alert for the specific patch bundles applicable to versions 12.2.1.4.0 and 14.1.2.1.0, then follow Oracle's documented patching procedure for Fusion Middleware components.

Workarounds

Restrict network access to OAM authentication endpoints using firewalls, reverse proxies, or WAF rules that permit only trusted client ranges.
Place OAM management interfaces behind VPN or zero-trust access controls until patches are applied.
Enable strict request validation at upstream proxies to drop malformed HTTP requests targeting the Authentication Engine.

bash

# Example: restrict OAM admin endpoint to internal networks via reverse proxy allow list
# Adjust the CIDR ranges and location paths to match your deployment
location /oam/ {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    proxy_pass https://oam-backend.internal:14100;
}