Oracle Access Manager CVE-2026-60326

Exploitation requires network HTTP reachability to an Oracle Access Manager instance running affected version 12.2.1.4.0 or 14.1.2.1.0 with the Authentication Engine component exposed - the same path used for normal SSO logins. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), there are no special conditions beyond reachability: remote unauthenticated exploitation is possible with no credentials and no user interaction against the affected configurations. The primary limiting factors are version (only 12.2.1.4.0 and 14.1.2.1.0 are named) and network exposure - deployments where the OAM authentication endpoints are not reachable from the attacker's network segment (e.g., internal-only, behind a filtering proxy) materially reduce realistic exploitability.

This is a genuine high-priority issue, not a high-CVSS-but-low-real-risk case. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) describes network-reachable, low-complexity exploitation requiring no privileges and no user interaction - Oracle itself characterizes it as 'easily exploitable,' which aligns with the vector. Confidentiality and integrity are both High; availability is Not affected, so this is a data-exposure and data-tampering threat rather than a denial-of-service one. No EPSS score, KEV listing, POC, or SSVC decision data was supplied, so exploitation-probability and automatability signals cannot be quantified from the input - the risk case rests on the CVSS vector, the authentication-bypass nature, and OAM's exposed perimeter role. The absence of a KEV/POC signal should not be read as low risk: identity-broker authentication bypasses are historically attractive targets, and the low complexity means weaponization could follow disclosure quickly. Treat as critical until patched.

An attacker with only network access to the OAM authentication endpoint sends crafted HTTP requests to the Authentication Engine and bypasses credential validation, obtaining unauthorized access to OAM-protected data and the ability to create, delete, or modify it. No credentials, no user interaction, and no elevated privileges are needed, and the low attack complexity means the technique is repeatable once known; no public exploit is identified at time of analysis.