Oracle Access Manager CVE-2026-73950

Exploitation requires network HTTP access to an Oracle Access Manager 12.2.1.4.0 or 14.1.2.1.0 instance's Authentication Engine; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special configuration are needed, so default deployments are exploitable. The primary limiting factor is network reachability of the OAM endpoint - internet-facing OAM gateways are directly at risk, while instances restricted to internal networks or behind additional access controls narrow the attack surface. Applying the Oracle September 2026 CPU fix removes the condition.

This is a genuine high-priority issue, and the 9.8 CVSS score is well-calibrated rather than inflated. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable, low-complexity, pre-authentication flaw in the Authentication Engine of Oracle Access Manager that Oracle itself characterizes as 'easily exploitable' and resulting in full 'takeover' - meaning complete confidentiality, integrity, and availability compromise of the SSO/IAM gateway that fronts many downstream applications. CWE-287 (improper authentication) plus the 'Authentication Bypass' tag are consistent with the described pre-auth compromise. The independent-signal picture is thinner: no EPSS score, no CISA KEV listing, no SSVC decision data, and no public POC were provided at time of analysis, so there is currently no evidence of active exploitation or automation. However, absence of these signals is expected for a freshly published Oracle Critical Patch Update item and should not be read as low risk - OAM pre-auth flaws have historically drawn rapid attacker interest (e.g., the earlier OAM pre-auth issue that reached CISA KEV). The core conflict is severity-versus-exploitation-evidence: maximal impact and trivial access requirements, but no confirmed in-the-wild use yet. Treat as urgent patching given the pre-auth network-exploitable nature and the product's role as an authentication chokepoint.

A remote, unauthenticated attacker sends crafted HTTP requests to the internet- or intranet-exposed Oracle Access Manager authentication endpoint, abusing a flaw in the Authentication Engine to bypass authentication and gain full control of the OAM instance. Because OAM brokers single sign-on for downstream enterprise applications, takeover can cascade into impersonation of any user and access to protected apps. No public exploit code was identified at time of analysis, but the low complexity and pre-auth vector make weaponization straightforward.