CVE-2026-73941

CVE-2026-73941 is a high-severity vulnerability in the Authentication Engine component of Oracle Access Manager (OAM), part of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.1.0. It is easily exploitable by an unauthenticated remote attacker with network access to an OAM server over HTTP, requiring no privileges or user interaction (CVSS 3.1: 8.6, AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N). Successful attacks result in unauthorized access to critical data or complete access to all OAM-accessible data — a confidentiality-only impact — and because the vulnerability has a scope change, attacks may significantly impact additional products beyond OAM itself. Organizations running the affected OAM versions as their single sign-on/authentication layer are at risk of broad data exposure across everything OAM protects. No public proof of concept is known and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, so there is currently no evidence of in-the-wild exploitation.

What to do: Apply Oracle's Critical Patch Update that remedies this CVE to all OAM installations on 12.2.1.4.0 and 14.1.2.1.0 as soon as it is available. Until patched, restrict HTTP(S) reachability of OAM authentication endpoints (VPN or IP allowlisting, deny-by-default at the edge) and monitor logs for anomalous unauthenticated requests against the Authentication Engine. Audit OAM-protected applications for signs of unauthorized data access and rotate credentials, sessions, and tokens if compromise is suspected.