What is the CVSS score of CVE-2026-60327?

CVE-2026-60327 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Access Manager are affected by CVE-2026-60327?

Oracle Access Manager (versions 12.2.1.4.0 and 14.1.2.1.0) contains an unauthenticated remote authentication bypass that allows attackers to access sensitive data and compromise your identity…

How to fix or mitigate CVE-2026-60327?

Within 24 hours, establish an incident response team and audit all access logs for unauthorized activity to Oracle Access Manager; immediately inventory all systems running vulnerable versions 12.2.1.4.0 and 14.1.2.1.0 and create a remediation priority list. Within 7 days, implement network-level access controls to restrict Oracle Access Manager to authorized networks only, deploy enhanced logging and alerting on authentication events, and evaluate whether non-critical instances can be temporarily disabled to reduce exposure. Within 30 days, apply Oracle's vendor patch once released in a Critical Patch Update, conduct full security assessment of all systems dependent on Access Manager for authentication, and review all integrated application access policies to enforce least-privilege principles.

Oracle Access Manager CVE-2026-60327

EUVD-2026-46742 HIGH

Improper Authentication (CWE-287)

2026-07-21 oracle

GHSA-c87v-4927-334g

Authentication Bypass Oracle Oracle Access Manager Oracle Corporation

8.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

8.6 HIGH

Unauthenticated remote HTTP access (AV:N/AC:L/PR:N/UI:N); authentication broker leaks data across trust boundaries (S:C, C:H) with no integrity or availability impact (I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:15 vuln.today

CVE Published

Jul 21, 2026 - 21:34 cve.org

HIGH 8.6

DescriptionCVE.org

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthorized data access in Oracle Access Manager (Fusion Middleware, Authentication Engine) 12.2.1.4.0 and 14.1.2.1.0 allows a remote, unauthenticated attacker to compromise confidentiality over HTTP, with a scope change that can significantly impact other Oracle products relying on it for single sign-on. Tagged as an Authentication Bypass, the flaw carries a CVSS 3.1 score of 8.6 and is addressed in the Oracle Critical Patch Update of July 2026. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

Oracle Access Manager (OAM) is the web access management and single sign-on (SSO) component of Oracle Fusion Middleware, brokering authentication and session tokens for downstream enterprise applications. The defect lies specifically in the Authentication Engine and is characterized by the vendor as enabling an unauthenticated network attacker to reach protected data. The vendor did not assign a CWE (CWE: N/A), but the 'Authentication Bypass' tag combined with the scope-change (S:C) and pure confidentiality impact (C:H, I:N, A:N) is consistent with a weakness that lets an attacker bypass or subvert authentication decisions to read data across trust boundaries, affecting resources beyond OAM itself. The affected CPE is cpe:2.3:a:oracle_corporation:oracle_access_manager, matching the SSO tier that fronts many Oracle middleware and custom applications.

RemediationAI

Apply the fixes in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) to the affected Oracle Access Manager releases 12.2.1.4.0 and 14.1.2.1.0 - Patch available per vendor advisory; the exact patched build should be taken directly from the CPU matrix for your version. Until patching is complete, reduce exposure by restricting network reachability of the OAM authentication endpoints: place OAM behind a VPN or IP allowlist, terminate untrusted HTTP access at a reverse proxy or WAF, and limit inbound access to only the application tiers and administrators that require it, accepting that tightening access may disrupt external SSO flows and federated partners. Because the flaw is unauthenticated over HTTP, network-layer restriction is the most reliable compensating control until Oracle's patch is deployed; monitor OAM authentication logs for anomalous access to protected resources in the interim.