Oracle Access Manager CVE-2026-60333

Exploitation requires network HTTP access to the Oracle Access Manager Authentication Engine and a low-privileged authenticated foothold (CVSS PR:L), but no user interaction and only low attack complexity - Oracle explicitly describes it as 'easily exploitable.' The affected configuration is any supported OAM 12.2.1.4.0 or 14.1.2.1.0 deployment; no non-default feature toggle is named as a prerequisite in the description. The primary limiting factor is that the attacker must possess some valid low-privilege access to OAM rather than being fully anonymous, and must be able to reach the OAM HTTP endpoints, so environments that isolate OAM management/authentication interfaces from untrusted networks materially raise the bar. The scope change (S:C) means a successful compromise is not confined to OAM and can affect additional trusting products.

This is a genuine high-priority issue rather than an inflated CVSS number. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, score 9.9) describes low-complexity network exploitation requiring only low privileges, no user interaction, and a scope change with full confidentiality, integrity, and availability loss - Oracle itself labels it 'easily exploitable.' The scope change is the critical signal: compromise does not stay contained to OAM but reaches additional products, magnifying blast radius for any environment where OAM fronts multiple applications. No EPSS score, SSVC decision, KEV listing, or public POC was provided, so real-world exploitation is unproven and should not be presented as active. The Information Disclosure tag is narrower than the vector's I:H/A:H impacts, which suggest full takeover - treat the CVSS vector, not the tag, as authoritative. The PR:L means an attacker still needs some level of valid low-privilege access, which modestly limits fully anonymous internet exploitation.

An attacker holding a low-privileged OAM account (or credentials phished/reused from a downstream app) sends crafted HTTP requests to the Access Manager Authentication Engine and abuses the flaw to escalate to full control of OAM. Leveraging the scope change, the attacker forges or manipulates authentication decisions to impersonate users and pivot into the downstream Fusion Middleware applications that trust OAM for SSO. No public POC is currently identified, so this reflects the CVSS-derived (AV:N/AC:L/PR:L) attack profile rather than an observed exploit.