CVE-2026-60355 in Access Manager
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within the Oracle Access Manager component of Oracle Fusion Middleware, specifically affecting the Authentication Engine module. The flaw represents a critical security weakness that can be exploited by unauthenticated attackers who have network access through HTTP protocols. The affected versions include 12.2.1.4.0 and 14.1.2.1.0, indicating this vulnerability spans multiple release branches of the Oracle Access Manager product line.
The technical nature of this flaw allows for remote exploitation without requiring any prior authentication credentials or privileged access. Attackers can leverage HTTP network connections to target the vulnerable authentication engine, making this particularly dangerous as it can be exploited from external networks. The CVSS score of 9.8 reflects the high severity of this vulnerability, with all three impact vectors rated as high - confidentiality, integrity, and availability. This scoring indicates that successful exploitation could result in complete system compromise where attackers gain full control over the Oracle Access Manager instance.
The operational impact of this vulnerability extends beyond simple unauthorized access to encompass complete system takeover capabilities. An attacker who successfully exploits this vulnerability could potentially gain administrative privileges, modify authentication mechanisms, access protected resources, and manipulate the underlying security infrastructure. This represents a significant threat to enterprise security frameworks that rely on Oracle Access Manager for identity and access management functions. The vulnerability's ease of exploitation means that skilled attackers with basic network reconnaissance capabilities could potentially compromise affected systems without specialized tools or techniques.
Organizations should prioritize immediate remediation through official Oracle patches and updates to address this vulnerability. Network segmentation strategies can provide temporary mitigation by limiting direct HTTP access to vulnerable systems, while implementing robust firewall rules and access controls can reduce attack surface. The vulnerability aligns with CWE-287 (Improper Authentication) and may map to ATT&CK techniques involving initial access through network service exploitation. Regular security assessments should verify that all instances of Oracle Access Manager are updated to supported versions, as this vulnerability could enable attackers to establish persistent access to enterprise authentication systems and potentially facilitate further attacks within the network infrastructure.