Oracle Access Manager CVE-2026-73947

Exploitation requires network access to the Oracle Access Manager Authentication Engine over HTTP; per the vendor CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no special privileges, and no user interaction are needed against affected versions 12.2.1.4.0 and 14.1.2.0.0. The main limiting factors are deployment-based rather than configuration-based: the target must be a running OAM instance of one of those two versions with its HTTP interface reachable by the attacker (many production OAM deployments sit behind reverse proxies or are internal-only, which narrows internet-wide exposure). No non-default feature toggle is documented as a prerequisite, and Oracle labels it 'easily exploitable.'

This is a genuine high-priority issue, not a high-CVSS-but-low-risk artifact. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) describes remote, unauthenticated, low-complexity exploitation requiring no user interaction against Oracle Access Manager's Authentication Engine - the exact component that gates single sign-on for downstream enterprise applications, so 'takeover of Oracle Access Manager' means compromise of the identity/SSO tier itself. All exploitation signals point the same direction rather than conflicting: attack vector is network, complexity low, privileges none. Oracle explicitly characterizes it as 'easily exploitable.' No EPSS score, no CISA KEV entry, and no public exploit code were provided at time of analysis, so there is currently no public exploit identified - but absence of these signals shortly after an Oracle Critical Patch Update disclosure is expected and does NOT lower the underlying severity. A near-identical prior flaw in this same product (CVE-2021-35587, OAM pre-auth takeover) was ultimately added to CISA KEV, indicating this vulnerability class attracts real-world exploitation once details surface. The only genuine information gap is technical: Oracle CPU advisories never disclose the endpoint, parameter, or protocol mechanism, so the precise trigger cannot be independently verified from the provided data.

An attacker with only network reachability to the Oracle Access Manager HTTP interface sends a crafted request to the Authentication Engine and bypasses authentication to fully compromise the OAM instance, with no credentials or user interaction needed. Because OAM brokers single sign-on, a successful takeover can cascade into impersonation of any user and access to every application protected by that SSO tier. No public proof-of-concept was identified at time of analysis, though a closely related prior OAM flaw (CVE-2021-35587) was later actively exploited.