CVE-2026-73945 Oracle CVE debrief

Who should care

Defenders responsible for Oracle Access Manager instances, specifically those using versions 12.2.1.4.0 and 14.1.2.1.0, should assess exposure and apply necessary patches or mitigations to prevent potential takeover.

Why it matters

A critical vulnerability in Oracle Access Manager requires immediate defensive action to assess exposure and apply patches or mitigations to prevent potential takeover and significant impacts on Confidentiality, Integrity, and Availability.

• Potential takeover of Oracle Access Manager by a low-privileged attacker.
• Significant impacts on Confidentiality, Integrity, and Availability.
• Exposure of sensitive data due to compromised Confidentiality.
• Potential disruption of service due to compromised Availability.

Technical summary

The vulnerability in Oracle Access Manager's Authentication Engine component allows a low-privileged attacker with network access via HTTP to easily compromise the system. Successful attacks can result in a takeover of Oracle Access Manager, with significant impacts on Confidentiality, Integrity, and Availability. The vulnerability affects versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Access Manager. Defenders should assess exposure and apply necessary patches or mitigations to prevent potential takeover. The CVSS 3.1 Base Score is 9.9, impacting Confidentiality, Integrity, and Availability.

Defensive priority

Immediate attention is required to assess exposure and apply necessary patches or mitigations to prevent potential takeover of Oracle Access Manager.

Recommended defensive actions

• Assess exposure of Oracle Access Manager instances, specifically versions 12.2.1.4.0 and 14.1.2.1.0.
• Apply patches or mitigations as recommended by Oracle.
• Monitor for potential takeover attempts of Oracle Access Manager.
• Review and update network access controls to limit exposure.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, its impacts, and affected versions. Oracle's advisory is referenced for further details. The vulnerability affects Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0. Evidence from the CVE Program and NVD detail page indicates a critical vulnerability allowing low-privileged attackers with network access via HTTP to compromise Oracle Access Manager easily. Successful attacks can lead to a takeover of Oracle Access Manager, with significant impacts on (

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.