CVE-2026-73945: Oracle Access Manager Auth Bypass Flaw

CVE-2026-73945 Overview

CVE-2026-73945 is a critical vulnerability in the Authentication Engine component of Oracle Access Manager, part of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with network access via HTTP can exploit the weakness to take over Oracle Access Manager. The vulnerability produces a scope change, meaning successful exploitation can impact additional products beyond the vulnerable component. Oracle addressed the issue in the Oracle Security Alert CSPUSEP2026.

Critical Impact
Successful exploitation results in full takeover of Oracle Access Manager with high impact to confidentiality, integrity, and availability, and may compromise downstream products relying on Access Manager for authentication.

Affected Products

Oracle Access Manager 12.2.1.4.0
Oracle Access Manager 14.1.2.1.0
Oracle Fusion Middleware deployments integrating Oracle Access Manager for authentication

Discovery Timeline

2026-09-15 - CVE-2026-73945 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-73945

Vulnerability Analysis

CVE-2026-73945 resides in the Authentication Engine of Oracle Access Manager, the component responsible for validating credentials and issuing session artifacts across integrated Fusion Middleware services. The flaw is categorized as Improper Access Control [CWE-284], allowing a low-privileged authenticated attacker to bypass intended authorization boundaries. Oracle rates the exploitability as easy, requiring only network access via HTTP and no user interaction. Because Access Manager brokers authentication for multiple downstream products, exploitation carries a scope change, meaning the compromise extends beyond the vulnerable component. Successful attacks yield full takeover of Access Manager, giving an adversary control over authentication decisions for the wider identity infrastructure.

Root Cause

The root cause is improper enforcement of access control within the Authentication Engine [CWE-284]. Oracle has not published implementation details, but the CWE indicates that the component fails to correctly restrict actions to authorized principals. This allows an authenticated attacker with minimal privileges to invoke functionality reserved for higher-trust identities.

Attack Vector

The attack vector is remote over HTTP. An attacker needs valid low-privilege credentials to the Access Manager endpoint. Once authenticated, the attacker sends crafted HTTP requests to the Authentication Engine to trigger the access control failure. Because the scope changes, subsequent actions can pivot into other Fusion Middleware services that trust Access Manager for identity assertions.

Oracle has not released public exploit details. See the Oracle Security Alert CSPUSEP2026 for authoritative technical guidance.

Detection Methods for CVE-2026-73945

Indicators of Compromise

Unexpected administrative or configuration changes within the Oracle Access Manager console or oam-config.xml.
Anomalous authentication tokens or OAM session cookies (OAM_ID, OAMAuthnCookie) issued to accounts without corresponding legitimate login events.
HTTP requests to Authentication Engine endpoints originating from low-privilege user sessions but returning elevated-scope responses.
New or modified authentication policies, resource protections, or identity provider trust relationships not tied to a change ticket.

Detection Strategies

Baseline normal Authentication Engine request patterns and alert on deviations in request rate, endpoint access, or response codes.
Correlate Access Manager audit logs with downstream Fusion Middleware application logs to detect scope-change activity following a single low-privilege login.
Review WebLogic and OHS access logs for repeated POST requests to OAM authentication endpoints paired with privilege-sensitive operations.

Monitoring Recommendations

Forward Oracle Access Manager audit logs, WebLogic server logs, and reverse-proxy access logs to a centralized SIEM for correlation.
Monitor administrative accounts and policy changes on OAM with real-time alerting.
Track outbound calls from OAM to downstream services and flag unexpected identity assertions.

How to Mitigate CVE-2026-73945

Immediate Actions Required

Apply the patches referenced in the Oracle Security Alert CSPUSEP2026 to all affected Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 deployments.
Rotate credentials, session keys, and trust material for Access Manager and integrated identity providers after patching.
Audit low-privilege OAM accounts and disable any that are unused or unnecessary to reduce the pool of usable attacker identities.
Review recent Access Manager configuration and policy changes for signs of unauthorized modification.

Patch Information

Oracle released fixes for CVE-2026-73945 in the Oracle Security Alert CSPUSEP2026. Administrators should consult the alert for the specific patch bundles applicable to their Fusion Middleware release train and apply them following Oracle's recommended deployment procedure.

Workarounds

Restrict network access to Oracle Access Manager administrative and Authentication Engine endpoints to trusted management networks using firewall or reverse-proxy rules.
Enforce multi-factor authentication for all accounts that can reach Access Manager to raise the cost of obtaining the low-privilege foothold required by the exploit.
Increase audit logging verbosity on OAM and forward logs to an out-of-band collector so tampering with local logs does not erase evidence.

bash

# Configuration example: restrict OAM admin endpoints at the reverse proxy
# Replace <trusted_cidr> with your management network range
<Location /oam/admin>
    Require ip <trusted_cidr>
</Location>
<Location /oamconsole>
    Require ip <trusted_cidr>
</Location>