CVE-2026-73962 Overview
CVE-2026-73962 is a broken access control flaw [CWE-284] in the Authentication Engine component of Oracle Access Manager, part of Oracle Fusion Middleware. Oracle addressed the issue in Security Alert CSPUSEP2026. The vulnerability affects supported versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with network access over HTTPS can compromise Oracle Access Manager without user interaction. The flaw carries a scope change, meaning successful exploitation can affect resources beyond the vulnerable component itself.
Critical Impact
Attackers with low privileges and network access can gain unauthorized read, create, modify, and delete access to all Oracle Access Manager accessible data, with impact extending to additional products through scope change.
Affected Products
- Oracle Access Manager 12.2.1.4.0
- Oracle Access Manager 14.1.2.1.0
- Oracle Fusion Middleware (Authentication Engine component)
Discovery Timeline
- 2026-09-15 - CVE-2026-73962 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-73962
Vulnerability Analysis
The vulnerability resides in the Authentication Engine of Oracle Access Manager (OAM), which brokers single sign-on and access control across Oracle Fusion Middleware deployments. Because OAM sits in front of enterprise applications as an authentication authority, a flaw at this layer undermines the trust boundary for every protected downstream resource.
Oracle categorizes the issue with a scope change, indicating that a successful attack against OAM can affect resources managed by other components. Confidentiality and integrity impacts are both rated high; availability is not affected. This maps to broken access control weaknesses classified under [CWE-284], where the authorization decision permits actions that should be denied. EPSS data lists the exploitation probability at 0.298%.
Root Cause
Oracle has not published implementation-level details. The advisory attributes the flaw to the Authentication Engine and classifies it as improper access control [CWE-284]. The condition allows a low-privileged authenticated actor to perform operations that should require higher privileges or be limited to different principals.
Attack Vector
Exploitation occurs over the network via HTTPS against the OAM endpoint. The attacker needs low-level privileges, such as a valid but unprivileged account, and no user interaction. Once exploited, the attacker can read, create, modify, or delete data accessible to OAM and pivot into other protected products due to the scope change.
No public proof-of-concept exploit is available, and CVE-2026-73962 is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Oracle Security Alert CSPUSEP2026 for authoritative technical guidance.
Detection Methods for CVE-2026-73962
Indicators of Compromise
- Unexpected authentication or authorization decisions logged by the OAM Authentication Engine for low-privileged accounts.
- Creation, modification, or deletion of OAM policy objects, user records, or session data outside change-management windows.
- HTTPS requests to OAM administrative endpoints originating from user accounts that do not normally reach those URLs.
Detection Strategies
- Enable verbose auditing on the OAM Authentication Engine and forward logs to a centralized analytics platform for correlation.
- Baseline normal HTTPS request patterns to OAM endpoints and alert on deviations by low-privileged principals.
- Correlate OAM access events with downstream application access to identify scope-change exploitation attempting cross-product access.
Monitoring Recommendations
- Monitor Oracle Fusion Middleware audit logs for policy or configuration changes by non-administrative users.
- Alert on unusual session token issuance or reuse patterns from the OAM tier.
- Track privilege escalation indicators between OAM and integrated applications such as WebLogic, Identity Governance, and downstream SSO consumers.
How to Mitigate CVE-2026-73962
Immediate Actions Required
- Apply the patches referenced in Oracle Security Alert CSPUSEP2026 to affected Oracle Access Manager deployments.
- Inventory all OAM instances running 12.2.1.4.0 or 14.1.2.1.0 and prioritize internet-exposed nodes.
- Rotate credentials and session tokens for accounts that may have interacted with unpatched OAM servers.
Patch Information
Oracle released fixes as part of Security Alert CSPUSEP2026. Administrators should review the alert notes for prerequisite patches, downtime requirements, and post-installation validation steps before deploying to production Fusion Middleware environments.
Workarounds
- Restrict network access to OAM administrative and authentication endpoints to trusted management networks using firewall and reverse-proxy rules.
- Enforce least privilege on OAM accounts and remove standing access from users who do not require it.
- Require multi-factor authentication for any account that can reach OAM interfaces to raise the cost of low-privileged account compromise.
# Configuration example
# Restrict OAM admin endpoint access at the reverse proxy layer
# (adjust IP ranges and paths for your environment)
<Location /oamconsole>
Require ip 10.0.0.0/8
Require ip 192.168.10.0/24
</Location>
<Location /oam/services/rest>
Require ip 10.0.0.0/8
</Location>
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.