What is the CVSS score of CVE-2026-73926?

CVE-2026-73926 has a CVSS 3.1 base score of 8.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Oracle CVE-2026-73926

EUVD-2026-79518 HIGH

2026-09-15 secalert_us@oracle.com

GHSA-45gw-qqgv-rv69

Authentication Bypass Oracle

8.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 20:41 vuln.today

CVE Published

Sep 15, 2026 - 20:17 nvd

HIGH 8.7

DescriptionNVD

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Access Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N).

AnalysisAI

Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 contain a flaw in the Authentication Engine component that lets a high-privileged, network-positioned attacker read, create, delete, or modify data managed by the OAM deployment — and because the flaw crosses a security scope boundary, downstream applications that trust OAM for identity can be affected as well. The CVSS 3.1 base score is 8.7 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N), reflecting an easily triggered but credentialed attack with high confidentiality and integrity impact and no availability impact. …