CVE-2026-73962
CriticalCVSS 9.6Summary
Vulnerability in Oracle Access Manager (Authentication Engine component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with network access via HTTPS can easily exploit it, potentially impacting additional products (scope change). It results in unauthorized access, creation, deletion, or modification of critical data. CVSS 3.1 Base Score: 9.6.
Risk Assessment
Very high risk — a low-privileged attacker can compromise confidentiality and integrity of critical data and affect related systems. It may lead to escalation across the environment.
Recommendation
Immediately install Oracle patches for Oracle Access Manager and verify that no unauthorized data changes have occurred.
Other vulnerabilities in Oracle Access Manager
See all- CVE-2015-2593High
Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.2.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Configuration Service.
- CVE-2015-0461High
Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.1.5 and 11.1.1.7 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Authentication Engine.
- CVE-2026-83001Critical
Vulnerability in Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Affects versions 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable, allows high privileged attacker via HTTP to take over the product, with impact on other products (scope change). CVSS 9.1.
- CVE-2026-73950Critical
Vulnerability in Oracle Access Manager (Authentication Engine component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via HTTP can easily exploit it to take over Oracle Access Manager. CVSS 3.1 Base Score: 9.8.
- CVE-2026-73947Critical
Vulnerability in Oracle Access Manager (Authentication Engine component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can easily exploit it to take over Oracle Access Manager. CVSS 3.1 Base Score: 9.8.
- CVE-2026-73946Critical
Vulnerability in Oracle Access Manager (Authentication Engine component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. A high-privileged authenticated attacker with network access via HTTP can compromise Oracle Access Manager, and the attack may significantly impact additional products (scope change).
- CVE-2026-73945Critical
Vulnerability in Oracle Access Manager (Authentication Engine component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with network access via HTTP can compromise Oracle Access Manager, and the attack may significantly impact additional products (scope change).
- CVE-2026-73944Critical
Vulnerability in Oracle Access Manager (Authentication Engine component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via HTTP can create, delete or modify critical data and gain complete access to Oracle Access Manager data.
- CVE-2026-73940Critical
Vulnerability in Oracle Access Manager (Authentication Engine component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via T3 or IIOP can compromise Oracle Access Manager.
- CVE-2026-71163Critical
Vulnerability in Oracle Access Manager (Authentication Engine component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with network access via HTTP can modify or delete critical data, gain complete access to it and cause a partial denial of service (partial DoS).
Original NVD description (English source)
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Access Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).