CVE-2026-60146 in Access Manager
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Access Manager accessible data as well as unauthorized read access to a subset of Oracle Access Manager accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within the Oracle Access Manager component known as the Authentication Engine, which forms part of Oracle Fusion Middleware. The affected versions include 12.2.1.4.0 and 14.1.2.1.0, representing critical components in enterprise identity and access management solutions. The vulnerability classification indicates it is easily exploitable, meaning that an attacker requires minimal technical expertise to leverage the flaw successfully. The attack vector operates through HTTP network access, suggesting that any system with exposed Oracle Access Manager services could be targeted without requiring prior authentication credentials.
The security implications of this vulnerability extend beyond the immediate component where the flaw exists. While the primary target is Oracle Access Manager, successful exploitation can trigger cascading effects that impact additional products within the broader Oracle Fusion Middleware ecosystem. This scope change characteristic significantly amplifies the potential damage surface and demonstrates how identity management vulnerabilities can create downstream risks across enterprise infrastructure. The CVSS score of 6.1 reflects a moderate severity level, with confidentiality and integrity impacts rated as low to moderate.
The attack requires human interaction from individuals other than the attacker, indicating that social engineering or user manipulation may be necessary components for successful exploitation. This aspect suggests that the vulnerability might be triggered through phishing campaigns, malicious links, or other deceptive means that prompt users to perform actions that inadvertently facilitate the attack. The potential consequences include unauthorized modification of data through update, insert, or delete operations on accessible Oracle Access Manager data. Additionally, attackers can gain unauthorized read access to subsets of data within the system, potentially exposing sensitive authentication information, user credentials, or access control configurations.
This vulnerability aligns with CWE-284 (Improper Access Control) and represents a classic case of insufficient authorization checks within the authentication framework. The attack pattern corresponds to techniques described in the MITRE ATT&CK framework under T1078 (Valid Accounts) and potentially T1566 (Phishing), depending on how the initial access is obtained. Organizations should implement immediate mitigations including network segmentation, firewall rules restricting HTTP access to Oracle Access Manager services, and thorough review of user access controls. Regular security updates and patch management processes become critical for maintaining system integrity, while monitoring logs for suspicious authentication attempts can help detect exploitation attempts before they succeed. The vulnerability demonstrates the importance of secure coding practices in authentication systems and the need for comprehensive security testing throughout the software development lifecycle to prevent such access control failures from reaching production environments.