Oracle Access Manager CVE-2026-73946

Exploitation requires the attacker to already hold HIGH privileges on Oracle Access Manager (PR:H) and network access over HTTP to the Authentication Engine component; no user interaction is needed (UI:N). Affected builds are Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0. The key limiting factor is the high-privilege prerequisite - this is a post-authentication / privileged-abuse flaw, not a pre-auth remote takeover, so realistic risk centers on malicious insiders, compromised admin accounts, or chained escalation. The scope change (S:C) means a successful attack can significantly impact additional integrated products that depend on OAM for authentication.

The vendor CVSS 3.1 score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) is driven largely by the scope change (S:C) and full C/I/A triad, not by ease of pre-auth access. The critical mitigating factor is PR:H: exploitation requires an attacker who already holds high privileges on Oracle Access Manager, so this is not an unauthenticated internet-facing takeover. Oracle self-describes it as 'easily exploitable' (consistent with AC:L) but only for an already-privileged actor. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no evidence of active exploitation or automatable mass-exploitation - SSVC-style signals point to a targeted, insider-or-post-compromise abuse rather than a widespread threat. Net: high theoretical severity because of scope change and full-impact takeover, but real-world urgency is tempered by the high-privilege precondition and absence of any exploitation evidence. The 'Information Disclosure' tag understates the issue - the vuln affects Confidentiality, Integrity AND Availability (full takeover), so it should not be treated as read-only. Verify affected versions and patch via the Oracle October 2026 Critical Patch Update advisory referenced.

An attacker who already possesses high-privilege administrative credentials on Oracle Access Manager sends crafted HTTP requests to the Authentication Engine component and abuses the flaw to fully compromise OAM. Because of the scope change, the compromise extends beyond OAM to additional integrated products that rely on it for authentication/SSO. No public exploit code was identified at time of analysis.