Oracle Access Manager CVE-2026-60328

Exploitation requires network HTTP reachability to the Oracle Access Manager Authentication Engine component on an affected version (12.2.1.4.0 or 14.1.2.1.0); no authentication, no user interaction, and no special product configuration is stated as a prerequisite. Per the CVSS vector AV:N/AC:L/PR:N/UI:N, this is remote unauthenticated exploitation against affected deployments. The primary limiting factor is exposure: OAM is typically deployed behind reverse proxies and load balancers on internal or DMZ networks, so an attacker needs a network path to the OAM endpoints, and only the two named supported versions are confirmed affected.

This is a genuine high-priority issue, not an inflated CVSS number. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes remote, network-facing, low-complexity, unauthenticated exploitation with no user interaction and total impact - the classic profile for internet- or intranet-exposed identity infrastructure that attackers prioritize. Oracle explicitly characterizes it as 'easily exploitable,' reinforcing the AC:L rating. No EPSS score was provided in the input, so exploitation probability cannot be quantified here, and the CVE is not listed in CISA KEV nor is a public POC referenced, so there is no confirmed active exploitation - the risk is currently derived from severity and product criticality rather than observed attacks. Because OAM is authentication infrastructure, a compromise cascades to every application that trusts it, so defenders should treat this as urgent despite the absence of exploitation telemetry.

An attacker with only network access to an OAM instance sends a crafted HTTP request to the Authentication Engine and, without any credentials or user interaction, gains full control of the Access Manager. From that foothold they can forge sessions, bypass authentication for every application fronted by OAM, and pivot into the broader identity fabric. No public POC is referenced, so an attacker would currently need to develop the exploit independently.