Oracle Access Manager CVE-2026-73962

Exploitation targets the Authentication Engine component of Oracle Access Manager (Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.1.0, reachable over HTTPS. The key limiting factor is that the attacker must already possess low-privilege access (PR:L) - this is not a pre-auth flaw, so a valid low-tier account or credential on the OAM instance is required. Beyond that, attack complexity is low, no user interaction is needed, and no non-default configuration is called out by Oracle. The scope change means a successful attack can extend beyond OAM to other products that rely on it for authentication, so exposure scales with how central the OAM deployment is to the environment's SSO fabric.

This is a genuinely high-priority vulnerability, though slightly less severe than pre-auth siblings in the same CPU. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N (9.6) describes an easily exploitable network attack (AV:N/AC:L) requiring only low privileges (PR:L) and no user interaction, yielding full confidentiality and integrity compromise (C:H/I:H) with a scope change (S:C) - Oracle explicitly states attacks 'may significantly impact additional products.' The scope change is what pushes this to 9.6 despite requiring authentication and having no availability impact (A:N). Cross-referencing exploitation signals: there is no CISA KEV listing, no public POC identified, and no EPSS score was supplied, so despite the high base score there is currently no evidence of active or imminent exploitation. The single authoritative source is the Oracle September 2026 Critical Patch Update (cspusep2026.html), which by convention publishes zero technical detail - no endpoint, parameter, or root-cause information. The 'Authentication Bypass' tag conflicts with the vector: PR:L means the attacker must already hold low-privilege access, so this is a privilege-escalation/data-compromise flaw against an authenticated attacker, NOT an authentication bypass. Net: prioritize patching because OAM is an SSO/IAM chokepoint and the scope change threatens downstream products, but the raw 9.6 overstates day-one urgency given no exploit evidence and the low-privilege prerequisite.

A low-privileged authenticated attacker (e.g., a holder of any valid low-tier OAM account or credential) sends crafted HTTPS requests to the Oracle Access Manager Authentication Engine and gains read and write access to all OAM-accessible data, then leverages the scope change to impact downstream products that trust OAM for authentication. No user interaction is required and attack complexity is low. No public proof-of-concept exploit has been identified at time of analysis.