CVE-2026-61067
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Access Manager executes to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within the Oracle Access Manager authentication engine component of Oracle Fusion Middleware, specifically affecting versions 12.2.1.4.0 and 14.1.2.1.0. The flaw represents a significant security weakness that can be exploited by attackers with physical access to the network segment where Oracle Access Manager operates. The CVSS base score of 8.0 indicates a high-severity vulnerability with impacts spanning confidentiality, integrity, and availability. The attack vector AV:A signifies that exploitation requires access to the physical communication segment, while AC:L demonstrates that the attack is easily executable with low complexity. The PR:L designation reveals that only low privileges are required for successful exploitation, making this vulnerability particularly dangerous as it can be leveraged by adversaries who have gained basic network access.
The technical nature of this vulnerability stems from weaknesses in the authentication engine's handling of network communications and session management processes. Attackers with physical presence on the network segment can potentially intercept, manipulate, or inject malicious data packets that compromise the authentication mechanisms. This type of vulnerability falls under CWE-284 Access Control Issues, specifically related to insufficient authentication checks and improper privilege management within the authentication engine. The operational impact extends beyond simple credential theft as successful exploitation can result in complete system takeover, allowing attackers to assume full administrative control over Oracle Access Manager services.
The implications of this vulnerability are particularly severe given that Oracle Access Manager serves as a critical component for enterprise authentication and access control. When compromised, attackers gain the ability to authenticate users, access protected resources, modify user permissions, and potentially escalate privileges within the broader Oracle Fusion Middleware environment. This compromise can lead to widespread data breaches, unauthorized system modifications, and complete loss of control over access management functions. The vulnerability's accessibility through physical network presence aligns with ATT&CK technique T1046 Network Service Scanning and T1566 Phishing, as attackers can leverage their physical access to conduct reconnaissance and exploit the authentication engine directly.
Organizations should implement immediate mitigations including strengthening physical security controls around network infrastructure, deploying network segmentation strategies to isolate Oracle Access Manager instances, and applying the latest security patches provided by Oracle. Network monitoring solutions should be enhanced to detect anomalous authentication patterns and unusual traffic flows on segments hosting Oracle Access Manager components. Additionally, organizations should review their access control policies to ensure that only authorized personnel have physical access to critical infrastructure, implementing multi-factor authentication mechanisms and regular security assessments of network access points. The vulnerability's classification as easily exploitable underscores the importance of proactive security measures rather than reactive responses, particularly in enterprise environments where Oracle Access Manager typically handles sensitive authentication workflows for large user bases and critical business applications.