CVE-2026-73962 is a critical vulnerability in Oracle Access Manager's Authentication Engine affecting versions 12.2.1.4.0 and 14.1.2.1.0. It allows a low privileged attacker with network access via HTTPS to compromise the product, resulting in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Access Manager. The vulnerability has a CVSS 3.1 score of 9.6 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, indicating network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high confidentiality and integrity impacts. Oracle has included fixes for this vulnerability in their September 2026 Critical Security Patch Update advisory.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data within Oracle Access Manager or complete access to all data accessible by the product. The vulnerability affects confidentiality and integrity with a critical severity rating (CVSS 9.6). While the vulnerability is specific to Oracle Access Manager, attacks may also impact additional Oracle products due to scope change.

Oracle has released patches for this vulnerability in the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these security patches without delay and remain on actively-supported versions. No alternative mitigations or temporary fixes are indicated. Refer to the official Oracle advisory at https://www.oracle.com/security-alerts/cspusep2026.html for patch availability and installation instructions.