CVE-2026-60358 in Access Manager
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within the Oracle Access Manager authentication engine component of Oracle Fusion Middleware, representing a critical security flaw affecting versions 12.2.1.4.0 and 14.1.2.1.0. The vulnerability manifests as an easily exploitable weakness that permits unauthenticated attackers to gain access to the system through HTTP network connections without requiring any prior authentication credentials or privileged access. The CVSS 3.1 scoring system assigns this vulnerability a perfect score of 10.0, indicating the highest possible severity level with impacts spanning confidentiality, integrity, and availability domains. This assessment aligns with CWE-287 which addresses improper authentication issues in software systems.
The technical nature of this flaw stems from inadequate authentication controls within the Oracle Access Manager's HTTP processing mechanisms, allowing attackers to bypass standard authentication procedures entirely. The vulnerability's network accessibility means that any system with exposed Oracle Access Manager services can be targeted without requiring physical access or insider knowledge of the organization's internal systems. Attackers can leverage this weakness to establish unauthorized control over the affected authentication engine, potentially gaining full administrative privileges and complete control over user access management functions. This represents a fundamental failure in the security architecture of the authentication system.
The operational impact of successful exploitation extends beyond the immediate compromise of Oracle Access Manager itself, creating what is known as scope change in vulnerability assessment terminology. This means that attacks targeting this specific weakness can potentially affect additional Oracle Fusion Middleware products and related systems within the organization's infrastructure. The compromised authentication engine could enable attackers to access other connected services that depend on Oracle Access Manager for user verification and authorization processes, creating cascading security failures throughout the enterprise environment.
The implications of such a high-severity vulnerability are particularly concerning given that it allows for complete system takeover without authentication requirements. Organizations relying on Oracle Access Manager for identity management and access control face significant risk of data breaches, unauthorized system modifications, and potential lateral movement attacks within their network infrastructure. The confidentiality impact is severe as attackers could access sensitive user credentials and authentication data stored within the compromised system. Integrity impacts arise from the potential for attackers to modify authentication policies, user accounts, or access permissions, while availability implications include possible denial of service conditions through system manipulation.
Organizations should implement immediate mitigations including network segmentation to restrict access to Oracle Access Manager services, deployment of web application firewalls to monitor and filter HTTP traffic, and application of Oracle's official security patches as soon as they become available. The vulnerability's classification under ATT&CK framework would likely map to techniques involving credential access and privilege escalation, making it particularly dangerous for organizations with insufficient network monitoring capabilities. Additionally, implementing comprehensive logging and monitoring solutions around authentication services becomes critical for detecting exploitation attempts and maintaining security posture against similar vulnerabilities in other Oracle Fusion Middleware components.