CVE-2026-73941 is a vulnerability in the Authentication Engine component of Oracle Access Manager within Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.1.0. The flaw allows an unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager, resulting in unauthorized access to sensitive data or full access to all data accessible by the product. The vulnerability has a CVSS 3.1 score of 8.6 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, scope change, and high confidentiality impact without integrity or availability impact. Oracle has released patches for this vulnerability in its September 2026 Critical Security Patch Update advisory, which includes 673 security fixes across multiple product families. Customers are urged to apply these patches without delay to prevent exploitation.

Successful exploitation of this vulnerability can lead to unauthorized access to critical data or complete access to all data accessible through Oracle Access Manager. The vulnerability affects confidentiality but does not impact integrity or availability. The scope of impact may extend to additional Oracle products due to the integration of Oracle Access Manager. This represents a significant risk to organizations using affected versions of Oracle Access Manager.

Oracle has released an official fix for this vulnerability as part of the September 2026 Critical Security Patch Update. Customers should apply the security patches provided by Oracle promptly to remediate this vulnerability. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay to prevent exploitation. No alternative mitigations or workarounds are indicated in the vendor advisory.