CVE-2026-61065 in Access Manager
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability exists within Oracle Access Manager's Authentication Engine component of Oracle Fusion Middleware, representing a critical security flaw that affects specifically version 12.2.1.4.0 and 14.1.2.1.0. The vulnerability stems from insufficient authentication controls that permit unauthenticated attackers to exploit the system through HTTP network connections without requiring any prior credentials or access privileges. This represents a fundamental failure in the authentication mechanism that undermines the core security posture of the platform.
The technical exploitation of this vulnerability occurs through network-based attacks that leverage the HTTP protocol to directly target the authentication engine. Attackers can potentially gain complete control over the Oracle Access Manager system, which would provide them with unrestricted access to all protected resources and services managed by the platform. The CVSS 3.1 scoring of 9.8 reflects the high severity nature of this flaw, with impacts rated as high for confidentiality, integrity, and availability. This means that successful exploitation could result in complete data compromise, system corruption, and service disruption that would severely impact organizational operations.
The operational impact of this vulnerability extends beyond simple unauthorized access to include potential lateral movement within networks where Oracle Access Manager serves as a critical authentication gateway. Organizations relying on this platform for securing access to enterprise applications and services face significant risk of data breaches, privilege escalation, and system compromise. The ease of exploitation means that even automated attack tools could potentially leverage this vulnerability without requiring specialized knowledge or extensive reconnaissance. This makes the vulnerability particularly dangerous in environments where such systems are not properly segmented or monitored.
Organizations should immediately implement network segmentation to isolate Oracle Access Manager instances from untrusted networks while applying the latest security patches provided by Oracle. Additional mitigations include implementing strict firewall rules that limit HTTP access to authorized administrative networks only, deploying intrusion detection systems to monitor for suspicious authentication attempts, and conducting comprehensive vulnerability assessments of all Oracle Fusion Middleware installations. The vulnerability aligns with CWE-287 which addresses improper authentication issues, and represents a significant risk under ATT&CK framework's credential access and privilege escalation tactics. Regular security monitoring and network traffic analysis should be enhanced to detect potential exploitation attempts, while access controls should be reviewed and strengthened across all authentication components to prevent unauthorized system compromise.