What is the CVSS score of CVE-2026-60146?

CVE-2026-60146 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Oracle Access Manager CVE-2026-60146

EUVD-2026-46554 MEDIUM

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-x9fj-3qvq-p69r

Authentication Bypass Oracle Oracle Access Manager Oracle Corporation

6.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vuln.today AI

6.1 MEDIUM

Network-delivered, no privileges required, but mandatory user interaction (UI:R); scope change reflects OAM's SSO position affecting downstream systems; no availability impact observed.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:29 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Access Manager accessible data as well as unauthorized read access to a subset of Oracle Access Manager accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

AnalysisAI

Unauthorized read and write access to Oracle Access Manager data is achievable by unauthenticated remote attackers through a network-accessible HTTP attack against the Authentication Engine component, affecting versions 12.2.1.4.0 and 14.1.2.1.0. The vulnerability carries a scope change, meaning successful exploitation can impact products beyond Oracle Access Manager itself - consistent with an authentication-layer flaw such as open redirect or reflected cross-site scripting that can compromise dependent applications sharing the SSO context. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in the CISA KEV catalog.

Technical ContextAI

Oracle Access Manager (OAM) is an enterprise identity and access management platform within the Oracle Fusion Middleware stack, responsible for centralized authentication, single sign-on (SSO), and policy enforcement across downstream applications. The affected component is the Authentication Engine - the subsystem that handles credential collection, session establishment, and authentication flow routing via HTTP. The CPE string (cpe:2.3:a:oracle_corporation:oracle_access_manager:*:*:*:*:*:*:*:*) confirms the flaw spans all sub-versions within the two named release branches. No CWE is assigned in the advisory, but the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L) is structurally consistent with a client-side injection class such as reflected XSS or open redirect embedded in the login/authentication flow, which would explain the mandatory user interaction, scope change, and split confidentiality/integrity impact without any availability component. Oracle tags this as an Authentication Bypass, suggesting the injection may allow manipulation of authentication state or session tokens visible to the browser.

RemediationAI

Apply the patches distributed as part of Oracle's Critical Patch Update for July 2026, available at https://www.oracle.com/security-alerts/cpujul2026.html. Oracle does not publish granular patched version strings independently of the CPU; the advisory is the authoritative reference for obtaining and applying the fix. No exact patched version number is independently confirmed beyond the CPU advisory reference. If immediate patching is not feasible, consider implementing a Web Application Firewall (WAF) rule set targeting the OAM authentication endpoint to detect and block reflected parameter injection patterns - note this may cause false positives on legitimate SSO redirects and requires tuning. Additionally, restricting external access to the OAM authentication portal to known IP ranges reduces exposure by limiting the attacker's ability to deliver malicious links to users originating from untrusted networks, though this does not eliminate risk from phishing scenarios where victims initiate requests themselves.