What is the CVSS score of CVE-2026-60328?

CVE-2026-60328 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Access Manager are affected by CVE-2026-60328?

Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 are vulnerable to unauthenticated remote complete system takeover via the Authentication Engine component of Oracle Fusion Middleware.

How to fix or mitigate CVE-2026-60328?

Within 24 hours, identify and inventory all Oracle Access Manager instances running versions 12.2.1.4.0 or 14.1.2.1.0 within your environment; immediately restrict network access to the Authentication Engine component through firewall rules or network segmentation, limiting exposure to only trusted administrative networks. Within 7 days, deploy Web Application Firewall (WAF) rules to monitor and block suspicious HTTP requests to the Authentication Engine, establish enhanced logging and alerting for access attempts, and engage with Oracle support to validate applicability to your infrastructure. Within 30 days, evaluate and implement architectural changes to isolate or replace vulnerable instances with alternative identity solutions where feasible, and establish a schedule with Oracle for patch availability tracking.

Oracle Access Manager CVE-2026-60328

EUVD-2026-46743 CRITICAL

Improper Authentication (CWE-287)

2026-07-21 secalert_us@oracle.com

GHSA-qgg4-48vf-pgc7

Authentication Bypass Oracle Access Manager

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle describes easily exploitable, remote, unauthenticated HTTP compromise with full takeover, so AV:N/AC:L/PR:N/UI:N and C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:31 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Access Manager is possible when an unauthenticated attacker with network access sends crafted HTTP requests to the Authentication Engine component of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.1.0 and yields full confidentiality, integrity, and availability compromise (CVSS 9.8). It was disclosed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis.

Technical ContextAI

Oracle Access Manager (OAM) is the enterprise web single sign-on and access-management component of Oracle Fusion Middleware, brokering authentication and session management for downstream applications via HTTP/S. The vulnerability resides in the Authentication Engine - the subsystem that validates credentials and issues authenticated sessions - meaning a defect there can bypass or subvert the very control that protects federated applications. Oracle did not assign a CWE (CWE: N/A) and the July 2026 CPU advisory does not disclose the technical root cause; the vendor tag 'Information Disclosure' hints at data exposure, though the CVSS vector rates all three impacts High, indicating full-system compromise rather than mere disclosure.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected Oracle Access Manager releases 12.2.1.4.0 and 14.1.2.1.0; the CPU is the vendor's release vehicle, but this input does not enumerate a specific patched build number, so consult the advisory's patch matrix for the exact patch/bundle for your release. Because no standalone fix version is independently confirmed here, if patching cannot be immediate, apply compensating controls: restrict network reachability of the OAM Authentication Engine endpoints to trusted management networks and known integration hosts via firewall or reverse-proxy allow-listing (trade-off: may break legitimate federated logins from unlisted networks and must be scoped carefully), place a WAF in front of OAM to inspect and filter anomalous authentication HTTP requests (trade-off: signature coverage is limited without root-cause detail), and increase monitoring of OAM authentication and admin logs for anomalous unauthenticated access. Do not expose OAM directly to the internet.