CVE-2026-60342
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Access Manager accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
The vulnerability under discussion represents a significant security weakness within Oracle Access Manager's authentication engine component, specifically affecting versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware. This flaw exists within the core authentication mechanisms that govern user access control and identity verification processes. The vulnerability's classification as easily exploitable indicates that attackers can leverage it with minimal technical expertise or resources, making it particularly concerning for organizations relying on this access management solution.
The technical nature of this vulnerability stems from insufficient authentication controls within the HTTP processing layer of Oracle Access Manager. An unauthenticated attacker positioned on the network can exploit this weakness to gain unauthorized access to specific data subsets within the system. The CVSS 3.1 scoring framework assigns a base score of 5.3, reflecting a medium severity threat that primarily impacts confidentiality aspects of the system. The vulnerability's vector analysis reveals that it requires no prior privileges or user interaction, making it accessible to any network entity capable of sending HTTP requests to the affected service.
The operational impact of this vulnerability extends beyond simple data exposure, as it fundamentally compromises the integrity of the authentication infrastructure. Attackers can potentially access sensitive user credentials, access control information, and other confidential data that should remain protected within the Oracle Access Manager environment. The subset access limitation suggests that while not all system data is compromised, the affected data categories could include critical identity management information that enables further attacks or unauthorized system access. Organizations utilizing these specific versions face significant risk of credential theft and unauthorized access to protected resources.
Security practitioners should immediately implement mitigation strategies including network segmentation to restrict access to Oracle Access Manager services, deployment of web application firewalls to monitor and filter HTTP traffic, and comprehensive network monitoring to detect anomalous access patterns. The vulnerability aligns with CWE-287, which addresses improper authentication issues in software systems, and maps to ATT&CK technique T1078 for valid accounts and T1566 for social engineering approaches that could leverage this weakness. Organizations should prioritize patching their Oracle Access Manager installations to the latest supported versions while implementing additional access controls and monitoring procedures to reduce the attack surface and prevent exploitation of this vulnerability.