CVE-2026-73947

A critical vulnerability (CVSS 9.8) in the Authentication Engine component of Oracle Access Manager (OAM), part of Oracle Fusion Middleware, allows an unauthenticated remote attacker with HTTP access to the server to completely take over the OAM installation. The flaw requires no privileges, no user interaction, and low attack complexity, so any internet-reachable OAM deployment is directly at risk; successful exploitation impacts confidentiality, integrity, and availability of the access management platform and, by extension, every application relying on it for single sign-on. Affected versions are OAM 12.2.1.4.0 and 14.2.0.0. Because OAM typically fronts enterprise authentication, a takeover can enable session theft and unauthorized access to downstream applications. As of this writing there is no known public proof of concept, the CVE is not on the CISA Known Exploited Vulnerabilities list, and no in-the-wild exploitation has been reported, though prior OAM flaws of this class have been targeted after disclosure.

What to do: Apply the Oracle Critical Patch Update that remediates this CVE to all OAM 12.2.1.4.0 and 14.2.0.0 installations as an emergency change. Until patched, restrict HTTP(S) access to OAM authentication and admin endpoints via firewall/VPN so only trusted networks can reach them, and enable WAF rules or virtual patching if the CPU guidance provides request signatures. Review OAM logs and configuration for unauthenticated anomalous requests, unexpected administrative sessions, or modified authentication policies that could indicate a compromise.