CVE-2026-73950

CVE-2026-73950 is a critical vulnerability in the Authentication Engine component of Oracle Access Manager (OAM), part of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.1.0. It is easily exploitable by an unauthenticated attacker with network access via HTTP, requiring no privileges or user interaction. A successful attack allows complete takeover of Oracle Access Manager, with high impact on confidentiality, integrity, and availability (CVSS 9.8). Because OAM sits in the authentication path for single sign-on, compromise can cascade into the applications and identity flows it fronts. No public proof of concept is known and the flaw is not on the CISA KEV list, so exploitation status is currently none known.

What to do: Apply the Oracle Critical Patch Update that fixes CVE-2026-73950 to all OAM instances on 12.2.1.4.0 or 14.1.2.1.0, prioritizing any OAM servers reachable from the internet. Until patched, restrict HTTP access to OAM endpoints (especially admin and authentication URLs) via firewall/WAF rules to trusted sources. Review OAM and reverse-proxy logs for unauthenticated anomalous requests or unexpected configuration changes that could indicate compromise.