CVE-2026-73946: Oracle Access Manager Auth Bypass Vulnerability

CVE-2026-73946 Overview

CVE-2026-73946 is an access control vulnerability in the Authentication Engine component of Oracle Access Manager, part of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.1.0. An authenticated attacker with high privileges and network access via HTTP can compromise the Oracle Access Manager instance. Successful exploitation results in complete takeover of Oracle Access Manager and produces a scope change that may impact additional downstream products. The weakness maps to Improper Access Control [CWE-284].

Critical Impact
Successful exploitation results in complete takeover of Oracle Access Manager with confidentiality, integrity, and availability impact extending beyond the vulnerable component due to scope change.

Affected Products

Oracle Access Manager 12.2.1.4.0
Oracle Access Manager 14.1.2.1.0
Oracle Fusion Middleware deployments relying on Oracle Access Manager for authentication

Discovery Timeline

2026-09-15 - CVE-2026-73946 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-73946

Vulnerability Analysis

The vulnerability resides in the Authentication Engine of Oracle Access Manager, the component responsible for enforcing authentication decisions across Oracle Fusion Middleware. Improper access control [CWE-284] allows a high-privileged authenticated user to bypass expected authorization boundaries within the engine. Because Oracle Access Manager brokers authentication for other Oracle products, successful compromise produces a scope change that extends impact beyond the vulnerable component itself. The result is full compromise of the Access Manager instance, including its ability to issue and validate authentication tokens for federated systems.

Root Cause

The root cause is improper access control within the Authentication Engine. The component fails to correctly enforce privilege boundaries on HTTP-accessible operations, allowing an attacker who already holds elevated credentials to escalate to full administrative control of Oracle Access Manager. Oracle has not published the specific code path in the public advisory.

Attack Vector

The attack is delivered over the network via HTTP. The attacker must already possess high privileges on the target, which limits the pool of potential adversaries to insiders, compromised administrative accounts, or attackers who first obtain elevated credentials through a separate vector. No user interaction is required. Technical details are available in the Oracle Security Alert CSPUSEP2026.

No public proof-of-concept exploit is available. The EPSS score at time of publication is 0.342% (27.6 percentile), reflecting the privileged-access prerequisite.

Detection Methods for CVE-2026-73946

Indicators of Compromise

Unexpected administrative or configuration changes within Oracle Access Manager, including new authentication schemes, policies, or identity provider trust relationships.
Anomalous HTTP requests to Oracle Access Manager administrative endpoints originating from accounts that do not normally perform administrative actions.
Issuance of authentication tokens or session artifacts for users or resources outside of documented workflows.

Detection Strategies

Correlate Oracle Access Manager audit logs with identity provider logs to surface privilege escalations, policy tampering, or unexpected federation trust changes.
Baseline administrative HTTP endpoints and alert on deviations in request frequency, source IP, or user agent.
Monitor for scope-change indicators: authentication decisions on downstream Fusion Middleware products that do not correlate to legitimate upstream sessions.

Monitoring Recommendations

Forward Oracle Access Manager audit and access logs to a centralized analytics platform for long-term retention and correlation.
Alert on privileged account activity outside of approved change windows, including configuration exports and credential store access.
Track federation and single sign-on token issuance volumes for statistical anomalies that may indicate misuse of a compromised Access Manager.

How to Mitigate CVE-2026-73946

Immediate Actions Required

Apply the patches referenced in the Oracle Security Alert CSPUSEP2026 to all affected Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 deployments.
Inventory all high-privileged Oracle Access Manager accounts and rotate credentials for any account whose activity cannot be fully attributed.
Restrict network access to Oracle Access Manager administrative HTTP interfaces to a hardened management network.

Patch Information

Oracle has released fixes as part of Oracle Security Alert CSPUSEP2026. Administrators should consult the alert for the specific patch bundle applicable to their Oracle Fusion Middleware version and apply it following Oracle's documented Access Manager patching procedure. Validate patch application by confirming the reported Access Manager version and reviewing post-patch audit logs.

Workarounds

Reduce the number of accounts holding high privileges on Oracle Access Manager to the minimum operationally necessary.
Enforce multi-factor authentication and jump-host access for all administrative sessions to Oracle Access Manager.
Segment Oracle Access Manager administrative endpoints from general user network segments using firewall or reverse proxy rules until patching is complete.

bash

# Example: restrict Oracle Access Manager admin console access at the network layer
# Replace 10.10.20.0/24 with your approved management subnet
iptables -A INPUT -p tcp --dport 7001 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7001 -j DROP