CVE-2026-73950 Oracle CVE debrief

Who should care

Defenders responsible for Oracle Access Manager deployments, particularly those using versions 12.2.1.4.0 and 14.1.2.1.0, should assess exposure and prioritize remediation. This includes verifying network access controls, applying vendor remediation, and reviewing compensating controls for exposed systems. Security teams and vulnerability management teams should also prioritize this vulnerability due to its critical severity and potential for system takeo

Why it matters

CVE-2026-73950 is a critical vulnerability in Oracle Access Manager that allows unauthenticated attackers to compromise the system, potentially leading to takeover. Defenders should prioritize verifying exposure, assessing network access controls, and applying vendor remediation.

• Potential system takeover by attackers
• Compromise of confidentiality, integrity, and availability
• Verification of network access controls and segmentation
• Prioritization of vendor remediation and patching

Technical summary

CVE-2026-73950 is a critical vulnerability in Oracle Access Manager's Authentication Engine, allowing unauthenticated attackers with network access via HTTP to compromise the system, potentially leading to takeover. The vulnerability affects versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Access Manager. Defenders should prioritize verifying exposure, assessing network access controls, and applying vendor remediation. The CVSS 3.1 Base Score is 9.8, indicating high confidentiality, integrity, and availability impacts.

Defensive priority

Defenders should prioritize verifying exposure of Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0, assessing network access controls, and applying vendor remediation.

Recommended defensive actions

• Verify exposure of Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 in your environment.
• Assess network access controls to prevent unauthorized access.
• Apply vendor remediation as available.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Oracle Access Manager, its impact, and affected versions. Evidence is limited to public sources, and defenders should verify exposure and assess network access controls. The CVE Program and NVD offer official details, while a vendor advisory provides additional guidance. Defenders should prioritize verifying exposure of Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.