CVE-2026-73962

Oracle Access Manager (OAM), the SSO/authentication tier of Oracle Fusion Middleware, contains a critical flaw (CVSS 3.1 base 9.6) in its Authentication Engine affecting versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker who already holds any valid account can exploit it over HTTPS with no user interaction, needing only network access and a low-complexity attack. Successful exploitation allows unauthorized creation, deletion, or modification of critical OAM data and complete read access to all data OAM can reach; because the scope changes, attacks can also significantly impact additional products that trust OAM for authentication. Any organization running the affected OAM versions as its web single sign-on layer is exposed, particularly where OAM endpoints are internet-facing. No public proof-of-concept is known, the flaw is not on CISA's KEV list, and no in-the-wild exploitation has been reported, though OAM flaws have historically attracted attackers after disclosure.

What to do: Apply the Oracle Critical Patch Update that remediates CVE-2026-73962 to OAM 12.2.1.4.0 and 14.1.2.1.0 (typically the April 2026 or later CPU bundle patch for each affected release). Restrict OAM administration and server endpoints to trusted networks or VPNs, and enforce MFA for accounts that can authenticate to OAM to blunt the low-privileged-attacker prerequisite. Review authentication policies, user stores, and audit logs on OAM instances for unauthorized changes or anomalous authenticated sessions.