CVE-2026-73944 Oracle CVE debrief

Who should care

Defenders responsible for Oracle Access Manager instances, especially those with unauthenticated network access via HTTP, should assess exposure and prioritize patching or compensating controls.

Why it matters

CVE-2026-73944 is a critical vulnerability in Oracle Access Manager that allows unauthenticated attackers to compromise the system via HTTP, potentially leading to unauthorized data access or modification. Defenders should prioritize verifying exposure and applying patches or compensating controls.

• Potential unauthorized creation, deletion, or modification of critical data.
• Possible unauthorized access to critical data or complete access to all Oracle Access Manager accessible data.
• Need for verification of Oracle Access Manager instances for exposure.
• Priority for applying vendor patches or compensating controls.

Technical summary

The vulnerability in Oracle Access Manager's Authentication Engine component allows unauthenticated attackers with network access via HTTP to compromise the system. This can lead to unauthorized creation, deletion, or modification of critical data, as well as unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. The CVSS 3.1 Base Score is 9.1, indicating a high impact on confidentiality and integrity. Affected versions include 12.2.1.4.0 and 14.1.2.1.0. Defenders should prioritize verifying exposure and applying vendor patches or compensating controls.

Defensive priority

Defenders should prioritize verifying exposure of Oracle Access Manager instances, especially those with unauthenticated network access via HTTP, and apply vendor patches or compensating controls.

Recommended defensive actions

• Verify Oracle Access Manager instances for exposure, especially those with unauthenticated network access via HTTP.
• Apply vendor patches or compensating controls to prevent unauthorized access.
• Monitor for suspicious activity and implement additional security measures to detect potential attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Oracle Access Manager, including affected versions (12.2.1.4.0 and 14.1.2.1.0) and CVSS score (9.1). The vulnerability allows unauthenticated attackers with network access via HTTP to compromise the system. Evidence from the CVE Program record and NIST NVD detail page supports this assessment. Defenders should verify exposure and apply patches or compensating controls. The vendor advisory also provides additional context for mitigating this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.