What is the CVSS score of CVE-2026-60325?

CVE-2026-60325 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Access Manager are affected by CVE-2026-60325?

Oracle Access Manager in Fusion Middleware 12.2.1.4.0 and 14.1.2.1.0 is vulnerable to complete authentication system compromise by authenticated insiders or adjacent-network attackers with low-level…

How to fix or mitigate CVE-2026-60325?

Within 24 hours: identify all Oracle Fusion Middleware systems running OAM in affected versions (12.2.1.4.0, 14.1.2.1.0) and restrict network access from untrusted internal network segments. Within 7 days: deploy the July 2026 Oracle Critical Patch Update to all identified OAM systems, confirming successful installation per vendor documentation. Within 30 days: validate patch deployment, audit OAM authentication logs for suspicious low-privileged account activity during the vulnerability exposure window, and conduct post-patch security testing of OAM functionality.

Oracle Access Manager CVE-2026-60325

EUVD-2026-46740 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-xx6w-f85v-2x49

Authentication Bypass Oracle Oracle Access Manager Oracle Corporation

8.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.0 HIGH

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

AV:A per Oracle's physical-segment requirement, PR:L for the required low-privilege foothold, AC:L/UI:N as stated, and C/I/A all High given full OAM takeover.

3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:16 vuln.today

CVE Published

Jul 21, 2026 - 21:34 cve.org

HIGH 8.0

DescriptionCVE.org

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Access Manager executes to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Access Manager (Authentication Engine component) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.1.0 is possible for a low-privileged attacker positioned on the same physical/adjacent network segment as the host running OAM. Per the CVSS vector (AV:A/AC:L/PR:L), exploitation is low-complexity and requires only some level of existing authenticated access plus adjacent network reachability, yielding complete confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis; addressed in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Access Manager is Oracle's enterprise identity and access management / single sign-on platform within Oracle Fusion Middleware, brokering authentication for downstream web applications and services. The flaw resides specifically in the Authentication Engine component, the subsystem responsible for validating credentials and issuing session assertions, so a compromise here undermines the trust anchor for every protected application that relies on OAM. No CWE was assigned in the source data, but the Oracle-supplied tag 'Information Disclosure' combined with the full C:H/I:H/A:H impact indicates the weakness allows an adjacent attacker to subvert the authentication logic itself rather than merely leak data. The affected footprint per CPE is cpe:2.3:a:oracle_corporation:oracle_access_manager, matching the two named supported releases.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update; patch available per vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html, which is the single source Oracle publishes fix versions through for OAM 12.2.1.4.0 and 14.1.2.1.0 (no standalone fix version was provided in the input, so consult the CPU matrix for the exact patch/PSU identifier for your release). Because the vector requires adjacency to the OAM host's network segment (AV:A), the most effective compensating control until patching is network segmentation: isolate OAM servers onto a dedicated, tightly access-controlled VLAN, restrict which hosts and accounts can reach the authentication segment, and monitor east-west traffic to that segment - the trade-off is added routing/firewall complexity and potential impact on legitimate management access. Tightening and auditing the low-privileged accounts that could serve as the PR:L foothold further reduces exploitability.