CVE-2026-73926

CVE-2026-73926 is a high-severity (CVSS 3.1: 8.7) vulnerability in the Authentication Engine component of Oracle Access Manager (OAM), part of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.1.0. The flaw is easily exploitable over the network via HTTP by an attacker who already holds high privileges, allowing them to fully compromise the Oracle Access Manager instance. Because the vulnerability carries a scope change, successful attacks can also significantly impact additional products beyond OAM itself. The impact is unauthorized creation, deletion, or modification of critical data — or all OAM-accessible data — as well as unauthorized read access to critical or all OAM-accessible data (high confidentiality and integrity impact, no availability impact). Organizations running OAM as their web SSO/identity enforcement point are affected; no public proof of concept exists and the CVE is not on the CISA KEV list, so no exploitation is currently known.

What to do: Apply the Oracle Critical Patch Update that addresses CVE-2026-73926 to OAM 12.2.1.4.0 and 14.1.2.1.0 as soon as it is available for your release line. Restrict network access to OAM administrative and internal endpoints so only trusted hosts and VPN ranges can reach them, since exploitation requires a high-privileged HTTP session. Review audit logs for anomalous activity by high-privileged OAM accounts and rotate those credentials if compromise is suspected.