What is the CVSS score of CVE-2026-60326?

CVE-2026-60326 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Access Manager are affected by CVE-2026-60326?

Oracle Access Manager (Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.1.0 contain a critical authentication bypass that allows unauthenticated remote attackers to read and modify all protected…

How to fix or mitigate CVE-2026-60326?

Within 24 hours: identify and inventory all Oracle Access Manager deployments and immediately isolate affected versions (12.2.1.4.0, 14.1.2.1.0) to trusted networks only, restricting inbound access to known administrative IP ranges. Within 7 days: deploy Web Application Firewall (WAF) rules to the OAM instances, implement enhanced audit logging to detect exploitation attempts, and establish daily monitoring of Oracle Security Advisories for patch availability. Within 30 days: prepare an upgrade or replacement strategy; if Oracle releases a patch, develop a tested deployment plan and schedule implementation; if no patch emerges within 30 days, escalate to architecture and business teams to plan OAM system replacement or disable non-critical OAM functions.

Oracle Access Manager CVE-2026-60326

EUVD-2026-46741 CRITICAL

Improper Authentication (CWE-287)

2026-07-21 oracle

GHSA-7v8w-hh6v-r9r7

Authentication Bypass Oracle Oracle Access Manager Oracle Corporation

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Unauthenticated network HTTP exploitation of the authentication engine with no user interaction gives AV:N/AC:L/PR:N/UI:N; bypass exposes and alters all accessible data (C:H/I:H) with no availability impact (A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:15 vuln.today

CVE Published

Jul 21, 2026 - 21:34 cve.org

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Access Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Authentication bypass in Oracle Access Manager (Oracle Fusion Middleware, Authentication Engine) versions 12.2.1.4.0 and 14.1.2.1.0 allows a remote, unauthenticated attacker to read and modify all data accessible to the product via crafted HTTP requests. Rated CVSS 3.1 9.1 with high confidentiality and integrity impact, the flaw was disclosed by Oracle in the July 2026 Critical Patch Update; there is no public exploit identified at time of analysis, and the low attack complexity plus no-privilege/no-interaction requirements make it a top-priority patch for any Oracle IAM deployment.

Technical ContextAI

Oracle Access Manager (OAM) is the enterprise single sign-on and access-management component of Oracle Fusion Middleware, brokering authentication and authorization for downstream web applications and portals. The defect resides in OAM's Authentication Engine, the subsystem that validates credentials and issues session/access tokens; the vendor tag 'Authentication Bypass' indicates the engine can be induced to grant access or trust without proper credential validation. NVD lists no CWE (N/A), but the behavior is consistent with the improper-authentication / authentication-bypass class (CWE-287/CWE-288), where a logic or validation flaw lets an actor assume a trusted state without satisfying the intended authentication checks. Because OAM sits at the perimeter as the identity gatekeeper, a bypass here undermines the trust boundary for every application it protects. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_access_manager, with confirmed affected releases 12.2.1.4.0 and 14.1.2.1.0.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) - patch available per vendor advisory; consult that document for the exact patch/bundle corresponding to Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0, as no standalone fix version string was provided in the input. Until patches are deployed, reduce exposure by restricting network reachability of the OAM authentication endpoints to trusted networks or via a reverse proxy/WAF that filters malformed authentication requests (trade-off: may break legitimate federated or external SSO flows), and increase monitoring of OAM authentication logs for anomalous session creation or access grants that lack a corresponding valid login (trade-off: detective, not preventive). Because OAM fronts many applications, coordinate the patch window carefully as it affects the SSO path for all protected services.