CVE-2026-73945

CVE-2026-73945 is a critical flaw in the Authentication Engine component of Oracle Access Manager (OAM), part of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with network access via HTTP can exploit it easily (no user interaction required), and because the vulnerability's scope changes, successful attacks can significantly impact products beyond OAM itself. A successful exploit results in full takeover of Oracle Access Manager with high impact to confidentiality, integrity, and availability — alarming for an identity/SSO product that brokers access to downstream applications. Any organization exposing an affected OAM deployment (commonly enterprises, governments, and financial institutions using it for web SSO) is affected. No public proof-of-concept exists and the flaw is not on the CISA KEV catalog, so no exploitation in the wild is currently known.

What to do: Apply the Oracle Critical Patch Update that remediates this CVE to both OAM 12.2.1.4.0 and 14.1.2.1.0 deployments as soon as it is available. In the interim, restrict network access to OAM HTTP endpoints (especially from untrusted networks), enforce strict authentication and least-privilege on OAM user accounts, and place WAF rules or reverse-proxy controls in front of OAM consoles. Review OAM audit logs for anomalous activity by low-privileged accounts, unexpected administrative changes, and any newly created agents or sessions, since compromise of OAM can cascade to all federated applications.