CVE-2026-73950: Oracle Access Manager Auth Bypass Vulnerability

CVE-2026-73950 Overview

CVE-2026-73950 is a critical authentication vulnerability in the Authentication Engine component of Oracle Access Manager, part of Oracle Fusion Middleware. Affected versions include 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated remote attacker can exploit the flaw over HTTP without user interaction, requiring only network access to the target. Successful exploitation results in full takeover of the Oracle Access Manager instance, compromising confidentiality, integrity, and availability. Oracle addressed the issue in its September 2026 Security Alert. The weakness is classified under CWE-287: Improper Authentication.

Critical Impact
Unauthenticated network attackers can fully take over Oracle Access Manager, gaining control over the enterprise single sign-on and identity federation infrastructure that governs access to downstream applications.

Affected Products

Oracle Access Manager 12.2.1.4.0
Oracle Access Manager 14.1.2.1.0
Oracle Fusion Middleware deployments using the Authentication Engine component

Discovery Timeline

2026-09-15 - CVE-2026-73950 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-73950

Vulnerability Analysis

The flaw resides in the Authentication Engine of Oracle Access Manager, the component responsible for validating user credentials and issuing session tokens for downstream applications. Because Oracle Access Manager mediates single sign-on across Fusion Middleware and integrated third-party systems, a takeover of the service exposes every application that trusts its authentication decisions.

Oracle classifies the vulnerability as easily exploitable over HTTP, with no privileges or user interaction required. An attacker with network reachability to the Oracle Access Manager endpoint can compromise the service and pivot to identity-layer attacks, including forging sessions, altering authentication policy, and extracting credentials or tokens issued by the service.

Root Cause

Oracle has not published detailed technical internals for the defect. The CWE-287 classification indicates an improper authentication condition in the Authentication Engine that allows a request path to bypass or subvert credential verification. Consult the Oracle Security Alert for the authoritative patch matrix and affected code paths.

Attack Vector

Exploitation occurs over the network using HTTP requests directed at the Oracle Access Manager service. The attacker does not need valid credentials, existing session material, or a user to click a link. Any Oracle Access Manager instance exposed to untrusted networks, including internet-facing single sign-on portals, is directly reachable by unauthenticated adversaries and should be treated as a priority target for patching.

Detection Methods for CVE-2026-73950

Indicators of Compromise

Unexpected administrative changes to authentication policies, identity stores, or agent registrations within Oracle Access Manager.
Issuance of session tokens or OAM cookies for accounts that did not perform an interactive login.
Anomalous HTTP requests to Oracle Access Manager endpoints originating from unfamiliar source addresses or user agents.
New or modified webgate, plugin, or authentication scheme configurations that were not initiated by change management.

Detection Strategies

Correlate Oracle Access Manager access logs with downstream application authentication events to identify sessions that lack a matching login flow.
Baseline the volume and structure of requests to the Authentication Engine and alert on deviations, especially unauthenticated request bursts.
Monitor administrative audit logs for policy, agent, or identity store modifications outside approved change windows.

Monitoring Recommendations

Forward Oracle Access Manager, WebLogic, and OHS access and audit logs to a centralized analytics platform for retention and correlation.
Alert on privileged operations performed by service or system accounts that normally do not modify authentication configuration.
Track outbound connections from Oracle Access Manager hosts to detect post-exploitation staging or exfiltration behavior.

How to Mitigate CVE-2026-73950

Immediate Actions Required

Apply the fixes referenced in the Oracle September 2026 Security Alert to all Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 deployments.
Inventory every Oracle Access Manager instance, including non-production and disaster recovery environments, and prioritize internet-exposed nodes.
Rotate administrative credentials, OAuth clients, and signing keys managed by Oracle Access Manager after patching.
Review authentication policies, webgate registrations, and identity store bindings for unauthorized changes.

Patch Information

Oracle released fixes as part of the September 2026 Security Alert. Refer to the Oracle Security Alert advisory for the definitive list of patched versions, download locations, and post-install steps for Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0.

Workarounds

Restrict network access to Oracle Access Manager management and authentication endpoints using firewalls or a reverse proxy allowlist until patches are applied.
Place Oracle Access Manager behind a web application firewall configured to inspect and rate-limit HTTP traffic to the Authentication Engine.
Disable or isolate unused authentication schemes and administrative interfaces to reduce reachable attack surface.
Increase log verbosity on Oracle Access Manager and downstream applications to support faster identification of exploitation attempts.

bash

# Example: restrict Oracle Access Manager admin endpoints to a management subnet
# Replace 10.10.20.0/24 with your trusted administration network
iptables -A INPUT -p tcp --dport 7001 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7001 -j DROP
iptables -A INPUT -p tcp --dport 14100 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 14100 -j DROP