CVE-2026-73940

Oracle Access Manager, the SSO and authentication component of Oracle Fusion Middleware, contains a critical flaw in its Authentication Engine that is remotely exploitable without any credentials over the T3 and IIOP protocols. An unauthenticated attacker with network reachability to the affected ports can fully compromise the Access Manager instance, gaining complete control over its confidentiality, integrity, and availability (CVSS 3.1: 9.8). Because OAM sits at the center of enterprise authentication, a takeover could enable session/token forgery, credential harvesting, and downstream access to every application it protects. Affected deployments are those running version 12.2.1.4.0 or 14.1.2.1.0. No public proof-of-concept exists and the flaw is not on the CISA KEV list, so exploitation status is currently none known.

What to do: Apply the Oracle Critical Patch Update covering CVE-2026-73940 to OAM 12.2.1.4.0 and 14.1.2.1.0 as the highest-priority change. Immediately block or restrict T3 and IIOP (typically ports 7001/14001 and related WebLogic-administered channels) at the network edge so only trusted administration hosts can reach them. Review OAM and WebLogic logs for unexpected T3/IIOP connections, deserialization errors, or new admin accounts, and rotate credentials and SSO signing keys if compromise is suspected.