What is the CVSS score of CVE-2026-73958?

CVE-2026-73958 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Which versions of Oracle are affected by CVE-2026-73958?

Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.0.0 contain a high-severity flaw in the Authentication Engine that exposes the enterprise identity service itself to full compromise by an…

How to fix or mitigate CVE-2026-73958?

Within 24 hours, inventory all deployed instances of Oracle Access Manager and confirm exactly which are running the affected versions 12.2.1.4.0 or 14.1.2.0.0, restrict network reachability to those instances so only trusted identity-provider traffic and required administrative networks can reach the Authentication Engine interfaces, and enable verbose authentication and access logging with alerting on anomalous or malformed authentication attempts. Within 7 days, apply any interim configuration hardening Oracle recommends in its advisory, validate that non-default states flagged by the AC:H vector are not inadvertently enabled, verify multi-factor authentication and conditional access policies are enforced for all federated applications, and rehearse incident response playbooks for identity-service compromise including credential and session-token revocation. Within 30 days, complete compensating-control validation through penetration testing or configuration review, engage Oracle support for a hotfix or patch timeline, and if no vendor-released patch is available, evaluate a compensating identity gateway or segmentation architecture that limits blast radius; continue weekly monitoring of Oracle and CISA advisories for an official fix and update this plan immediately when one is published.

Oracle CVE-2026-73958

EUVD-2026-79312 HIGH

2026-09-15 secalert_us@oracle.com

GHSA-p45v-w7qf-hx25

Information Disclosure Oracle

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 20:39 vuln.today

CVE Published

Sep 15, 2026 - 20:17 nvd

HIGH 8.1

DescriptionNVD

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Unauthenticated network attackers can achieve full takeover of Oracle Access Manager via a difficult-to-trigger flaw in the Authentication Engine component of Oracle Fusion Middleware, affecting versions 12.2.1.4.0 and 14.1.2.0.0. Oracle rates this CVSS 3.1 8.1 with High confidentiality, integrity, and availability impact from a network vector requiring no privileges or user interaction, meaning the identity service itself — and the applications it protects — can be fully compromised. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Recommended ActionAI

Within 24 hours, inventory all deployed instances of Oracle Access Manager and confirm exactly which are running the affected versions 12.2.1.4.0 or 14.1.2.0.0, restrict network reachability to those instances so only trusted identity-provider traffic and required administrative networks can reach the Authentication Engine interfaces, and enable verbose authentication and access logging with alerting on anomalous or malformed authentication attempts. …

Threat intelligence, references, and detailed analysis are available after sign-in.