CVE-2026-73947: Oracle Access Manager Auth Bypass Vulnerability

CVE-2026-73947 Overview

CVE-2026-73947 is an authentication vulnerability in the Oracle Access Manager (OAM) product of Oracle Fusion Middleware. The flaw resides in the Authentication Engine component and affects supported versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access over HTTP can exploit the issue to fully compromise Oracle Access Manager. Successful exploitation results in complete takeover of the OAM instance, impacting confidentiality, integrity, and availability. The weakness is classified under [CWE-287: Improper Authentication].

Critical Impact
Unauthenticated network attackers can take over Oracle Access Manager instances, bypassing the identity and single sign-on layer that protects downstream Fusion Middleware applications.

Affected Products

Oracle Access Manager (Oracle Fusion Middleware) 12.2.1.4.0
Oracle Access Manager (Oracle Fusion Middleware) 14.1.2.0.0
Authentication Engine component of Oracle Access Manager

Discovery Timeline

2026-09-15 - CVE-2026-73947 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database
2026-09-15 - Oracle Security Alert CSPUSEP2026 published

Technical Details for CVE-2026-73947

Vulnerability Analysis

Oracle Access Manager provides authentication, authorization, and single sign-on (SSO) services for Oracle Fusion Middleware environments. The Authentication Engine processes credential exchanges and issues session tokens that downstream applications trust. A flaw in this engine allows a remote, unauthenticated attacker to bypass authentication controls over HTTP.

Because OAM sits at the trust boundary for many enterprise applications, a compromise cascades. An attacker who takes over OAM can issue valid sessions, impersonate any user, and reach applications that rely on OAM assertions. Oracle addressed the issue in Security Alert CSPUSEP2026 outside the normal Critical Patch Update cycle, indicating out-of-band urgency.

Root Cause

The root cause is improper authentication ([CWE-287]) within the Authentication Engine. The engine fails to correctly validate a request property required to prove identity, allowing attacker-controlled input to satisfy the authentication check without valid credentials. Oracle has not published exploitation specifics in the public advisory.

Attack Vector

The attack vector is network-based over HTTP. No prior authentication, elevated privileges, or user interaction is required. An attacker with reachability to the OAM login or authentication endpoints can send crafted HTTP requests to the Authentication Engine to bypass identity checks and gain administrative control over the OAM instance.

No verified proof-of-concept code is publicly available at the time of publication. Refer to the Oracle Security Alert CSPUSEP2026 for authoritative technical details.

Detection Methods for CVE-2026-73947

Indicators of Compromise

Unexpected administrative sessions or configuration changes within OAM consoles that do not correlate with legitimate admin activity.
Authentication success events lacking a preceding credential validation event in OAM audit logs.
Unusual HTTP POST or GET traffic to OAM authentication endpoints (/oam/server/*, /oamsso/*) from untrusted networks.
Newly issued OAM session tokens for high-privilege accounts outside normal business hours or from atypical source IPs.

Detection Strategies

Baseline normal request patterns to OAM authentication endpoints and alert on anomalies in request structure, header content, or parameter usage.
Correlate OAM audit events with WebGate access logs to identify sessions that lack a corresponding successful credential exchange.
Monitor for privilege escalation within OAM policy stores and identity domains, particularly changes to administrator groups or authentication schemes.

Monitoring Recommendations

Forward OAM Managed Server, WebGate, and OHS access logs into a centralized analytics platform for retention and correlation.
Alert on modifications to OAM policy configuration files and authentication modules under $DOMAIN_HOME/config/fmwconfig.
Track outbound activity from OAM hosts to detect post-compromise lateral movement toward Oracle Internet Directory, database, or federated identity providers.

How to Mitigate CVE-2026-73947

Immediate Actions Required

Apply the patches referenced in Oracle Security Alert CSPUSEP2026 to all OAM instances running 12.2.1.4.0 or 14.1.2.0.0.
Restrict network access to OAM administrative and authentication endpoints so that only trusted reverse proxies and WebGates can reach them.
Rotate OAM administrative credentials, signing keys, and session encryption keys after patching to invalidate any tokens issued during a potential compromise.
Review OAM audit logs for signs of unauthorized authentication events dating back to before patch deployment.

Patch Information

Oracle released fixes as part of Security Alert CSPUSEP2026. Administrators should download and apply the OAM bundle patches applicable to their Fusion Middleware version through My Oracle Support. Because this is an out-of-cycle Security Alert, patching should not wait for the next quarterly Critical Patch Update.

Workarounds

Place OAM behind a hardened reverse proxy or WAF that enforces strict validation on requests to the Authentication Engine.
Block direct external access to OAM Managed Server ports and expose only WebGate-fronted endpoints.
Enable enhanced auditing on OAM to capture authentication attempts and configuration changes for forensic review.

bash

# Example: restrict inbound access to OAM Managed Server ports with iptables
iptables -A INPUT -p tcp --dport 14100 -s <trusted_webgate_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 14100 -j DROP

# Verify current OAM patch inventory via OPatch
cd $ORACLE_HOME/OPatch
./opatch lsinventory | grep -i "Access Manager"