CVE-2026-73958 Oracle CVE debrief

Who should care

Administrators and security teams responsible for Oracle Access Manager deployments should assess exposure and apply patches or mitigations as needed. This includes reviewing current security controls, configurations, and incident response plans. They should also monitor network traffic for suspicious activity and perform vulnerability scanning and penetration testing to identify potential weaknesses. Security teams should prioritize patching and securing

Why it matters

This vulnerability in Oracle Access Manager requires attention from administrators and security teams to assess exposure and apply patches or mitigations to prevent potential compromise.

• Potential takeover of Oracle Access Manager
• Compromise of confidentiality, integrity, and availability

Technical summary

The vulnerability is in the Authentication Engine component of Oracle Access Manager, affecting versions 12.2.1.4.0 and 14.1.2.0.0. It has a CVSS score of 8.1 and can result in confidentiality, integrity, and availability impacts. The vulnerability allows unauthenticated attackers with network access via HTTP to potentially compromise the product. Successful attacks can result in a takeover of Oracle Access Manager. The CVE record and NVD detail page provide information on the vulnerability, its impacts, and affected versions.

Defensive priority

High priority for authentication and access management systems

Recommended defensive actions

• Review and apply Oracle's security patches for affected versions of Oracle Access Manager
• Implement additional authentication and authorization controls for access to Oracle Access Manager
• Monitor network traffic for suspicious activity related to Oracle Access Manager
• Conduct a thorough review of current security controls and configurations for Oracle Access Manager
• Perform vulnerability scanning and penetration testing to identify potential weaknesses
• Develop and implement incident response plans for potential compromises
• Review and update asset inventory and configuration management for Oracle Access Manager deployments

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, its impacts, and affected versions. The vulnerability is in the Authentication Engine component of Oracle Access Manager, affecting versions 12.2.1.4.0 and 14.1.2.0.0. It has a CVSS score of 8.1 and can result in confidentiality, integrity, and availability impacts. There is no evidence of exploitability or specific attack vectors beyond network access via HTTP. Defenders should verify affected product deployments and review official advisories for guidance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.