Oracle Access Manager CVE-2026-73945

Requires network HTTP access to the Oracle Access Manager Authentication Engine component and a low-privileged authenticated foothold (PR:L) - this is NOT unauthenticated. No user interaction is needed and attack complexity is low, so once an attacker holds any valid low-level account, exploitation is straightforward against affected versions 12.2.1.4.0 and 14.1.2.1.0. The main limiting factors are the authentication prerequisite and applicability only to those specific Fusion Middleware OAM releases; the scope change means successful exploitation can extend impact to other products that federate authentication through OAM.

This is a genuine high-priority vulnerability, not a paper tiger. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 9.9) describes a network-reachable, low-complexity flaw needing only low privileges and no user interaction, culminating in full takeover of Oracle Access Manager with a scope change that Oracle explicitly says 'may significantly impact additional products.' Because OAM is a central SSO/identity broker, the scope change is credible and dangerous - compromise of the auth engine can cascade into every downstream application relying on it for authentication. Weighing the signals: exploitability is high and the impact is a full CIA triad takeover, but exploitation maturity is low - there is no CISA KEV listing, no public POC, and no EPSS score supplied, so there is no evidence of active exploitation at time of analysis. The absence of exploitation signals should not lower prioritization much: Oracle IAM components are high-value targets and Oracle-self-reported CPU flaws are patched on a quarterly cadence that attackers reverse-engineer. Note the PR:L requirement - this is NOT unauthenticated; an attacker needs some low-level authenticated foothold, which is the main practical limiter. The 'Information Disclosure' tag is misleading given the full C/I/A takeover impact.

A low-privileged attacker with an authenticated foothold (e.g., a basic OAM user account) sends crafted HTTP requests to the Authentication Engine component and abuses the flaw to escalate to full compromise of Oracle Access Manager. Because of the scope change, the attacker can then pivot to impact downstream applications that trust OAM for single sign-on. No public exploit code has been identified at time of analysis, and no user interaction is required.