CVE-2026-73958: Oracle Access Manager Auth Bypass Flaw

CVE-2026-73958 Overview

CVE-2026-73958 affects the Authentication Engine component of Oracle Access Manager, part of Oracle Fusion Middleware. The flaw allows an unauthenticated remote attacker with network access via HTTP to compromise the product. Successful exploitation results in complete takeover of Oracle Access Manager, impacting confidentiality, integrity, and availability. Oracle classifies the vulnerability as difficult to exploit, but the impact on identity infrastructure warrants immediate attention. The affected versions are 12.2.1.4.0 and 14.1.2.0.0. Oracle addressed the issue in its September 2026 security alert.

Critical Impact
An unauthenticated network attacker can achieve full takeover of Oracle Access Manager, compromising the enterprise authentication tier that brokers access to downstream applications.

Affected Products

Oracle Access Manager 12.2.1.4.0
Oracle Access Manager 14.1.2.0.0
Oracle Fusion Middleware (Authentication Engine component)

Discovery Timeline

2026-09-15 - CVE-2026-73958 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database
September 2026 - Oracle releases fix via the Oracle Security Alert

Technical Details for CVE-2026-73958

Vulnerability Analysis

The vulnerability resides in the Authentication Engine of Oracle Access Manager (OAM), the module responsible for validating credentials and issuing session tokens for federated applications. Because OAM sits in front of business-critical applications, a compromise of the Authentication Engine effectively defeats the enterprise single sign-on perimeter. Oracle categorizes the issue under [CWE-284: Improper Access Control], indicating that access decisions or trust boundaries within the authentication flow are not enforced correctly.

Exploitation requires no authentication and no user interaction. The attacker only needs HTTP reachability to the OAM endpoint. Oracle rates attack complexity as high, meaning specific conditions or preparatory steps must be met, such as timing, protocol state, or knowledge of internal request formats. Successful exploitation yields full takeover, allowing the attacker to forge sessions, impersonate users, or modify authentication policies.

Root Cause

The root cause is improper access control within the Authentication Engine component. The engine fails to correctly restrict a security-sensitive operation to authorized callers, allowing an unauthenticated HTTP request to reach protected functionality. Oracle has not published detailed technical internals for this issue.

Attack Vector

The attack vector is network-based over HTTP. An attacker sends crafted requests to an internet-exposed or intranet-exposed OAM instance. Because OAM commonly terminates authentication for many downstream applications, an attacker who takes over OAM inherits control of the identity fabric. See the Oracle Security Alert for the vendor advisory.

No public proof-of-concept exploit is available at the time of publication. The exploitation code example is omitted because no verified technical detail has been released.

Detection Methods for CVE-2026-73958

Indicators of Compromise

Unexpected administrator or policy changes within Oracle Access Manager configuration stores
Anomalous session token issuance for accounts that did not perform interactive authentication
HTTP requests to OAM authentication endpoints from unusual source IP addresses or with malformed parameters
New or modified authentication schemes, plugins, or identity providers registered without a change ticket

Detection Strategies

Baseline normal OAM HTTP traffic and alert on deviations in request paths, headers, or parameter patterns targeting the Authentication Engine
Correlate OAM audit logs with downstream application access logs to identify tokens used without a corresponding authentication event
Monitor WebLogic and OAM server logs for stack traces, error bursts, or unexpected restarts around authentication endpoints

Monitoring Recommendations

Forward OAM, WebLogic, and reverse proxy logs to a centralized analytics platform for correlation and retention
Alert on privileged operations against OAM policy stores outside of maintenance windows
Track outbound connections from OAM hosts to detect post-exploitation staging or data exfiltration

How to Mitigate CVE-2026-73958

Immediate Actions Required

Apply the fixes referenced in the Oracle Security Alert for Oracle Access Manager 12.2.1.4.0 and 14.1.2.0.0
Restrict network exposure of OAM administrative and authentication endpoints to trusted segments only
Rotate OAM administrator credentials, signing keys, and any shared secrets used by federated partners after patching
Review OAM audit logs for the past 90 days to identify anomalous authentication or configuration activity

Patch Information

Oracle addressed this vulnerability in its September 2026 security alert. Administrators should review the Oracle Security Alert and apply the patches for the affected versions. Because OAM upgrades often require WebLogic domain updates, coordinate deployment with application owners to avoid extended downtime.

Workarounds

Place OAM behind a web application firewall configured to inspect and rate-limit requests to the Authentication Engine endpoints
Enforce mutual TLS or IP allow-listing between OAM and any exposed reverse proxy tier
Disable unused authentication schemes and plugins to reduce the attack surface until patching completes

bash

# Example: restrict access to OAM authentication endpoints at the reverse proxy
# (Apache HTTPD snippet - adjust paths for your OAM deployment)
<Location /oam/server>
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>