External risk intelligence

Oracle Access Manager Authentication Engine Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-73950

Oracle Access Manager is an identity and access management solution that is typically deployed as a public-facing gateway or portal to manage authentication services for users and applications, making its endpoints inherently exposed to the network.

Authentication Bypass

Oracle Access Manager

12.2.1.4.014.1.2.1.0

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in Oracle Access Manager, an authentication product, that could allow an unauthenticated attacker to completely take over the system. This issue impacts the confidentiality, integrity, and availability of the system with a base score of 9.8.

Unauthenticated attackers can fully compromise Oracle Access Manager.
This critical flaw impacts a core identity and access management system.
Confirm relevance and exposure of Oracle Access Manager.

Attack Path

How an attacker could exploit the issue

An attacker could reach Oracle Access Manager over the network without needing any prior access or authentication. The vulnerability resides within the Authentication Engine component, and if triggered, it could allow the attacker to fully take control of the Oracle Access Manager.

Attacker needs network access.
Unauthenticated HTTP request triggers it.
Full takeover of the product.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact Oracle Access Manager, potentially allowing an attacker to gain complete control of the system. This could expose sensitive information and disrupt services when the component is exposed externally.

Risk to Oracle Access Manager control.
Exploitable over the network via HTTP.
Complete system takeover possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Oracle Access Manager, a component of Oracle Fusion Middleware, impacts authentication engines. Given its role in managing access, the platform team or security operations should lead the initial response. The first practical step is to identify all instances of the affected Oracle Access Manager, determine their network accessibility and business criticality, and confirm the accountable owner for each instance before planning remediation.

Platform/security teams own this issue.
Verify network exposure and business criticality.
Plan remediation based on risk and ownership.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle Access Manager?

Oracle Access Manager is a core component of Oracle Fusion Middleware used to manage identity and authentication services. It acts as a gatekeeper, validating user credentials and controlling access to enterprise applications and resources.

What does CWE-287 and CWE-306 mean for CVE-2026-73950?

These codes indicate failures in authentication and missing authentication for critical functions. In the context of CVE-2026-73950, this means the software's identity verification process can be bypassed, allowing unauthorized access to sensitive system controls.

How is this vulnerability triggered?

An attacker triggers this vulnerability by sending a specifically crafted HTTP request to the Authentication Engine component. No prior authentication, user interaction, or existing account access is required for the request to initiate the takeover.

Is my system relevant according to Halo Surface Signal?

Yes, if you use this software. Halo Surface Signal identifies Oracle Access Manager as an identity gateway often deployed to face the network, making its endpoints inherently exposed and a primary target for external threats.

What is the first step to address CVE-2026-73950?

Begin by inventorying your environment to locate all instances of Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0. Once identified, map their network connectivity and business importance to prioritize your response plan.

References

www.oracle.com/security-alerts/cspusep2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.