What is the CVSS score of CVE-2026-60333?

CVE-2026-60333 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Access Manager are affected by CVE-2026-60333?

Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 contain a privilege escalation vulnerability (CVSS 9.9) with no public exploit identified at time of analysis, allowing low-privileged network…

How to fix or mitigate CVE-2026-60333?

Within 24 hours, inventory all Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 deployments, assess network exposure, and prepare contingency isolation procedures if immediate patching is not possible. Within 7 days, test Oracle's July 2026 Critical Patch Update in non-production environments to validate application compatibility before production rollout. Within 30 days, deploy the July 2026 Critical Patch Update to all affected production systems, verify remediation, and review authentication logs for exploitation attempts during the exposure window.

Oracle Access Manager CVE-2026-60333

EUVD-2026-46748 CRITICAL

Improper Authentication (CWE-287)

2026-07-21 secalert_us@oracle.com

GHSA-m8mw-5f48-qq89

Oracle Authentication Bypass Access Manager

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

Network HTTP reachable and low-complexity per Oracle; needs a low-privilege foothold (PR:L); authentication-engine takeover with scope change to trusting products gives S:C and full C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:46 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.9

DescriptionCVE.org

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Privilege escalation to full takeover in Oracle Access Manager (Fusion Middleware) 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged, network-based attacker to compromise the Authentication Engine over HTTP and pivot beyond the product itself (scope change). Because Access Manager brokers single sign-on and authentication for downstream Fusion Middleware applications, its compromise cascades into the identity trust chain. Rated CVSS 3.1 9.9 with full CIA impact; no public exploit identified at time of analysis, and it is addressed in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Access Manager (OAM) is the enterprise access-management and web single sign-on (SSO) component of Oracle Fusion Middleware, responsible for authenticating users and issuing session tokens consumed by downstream applications and WebGates. The flaw resides specifically in the Authentication Engine, the subsystem that validates credentials and establishes authenticated sessions. Oracle does not assign a CWE (CWE: N/A), but the scope-change behavior (CVSS S:C) combined with an authentication component points to a trust-boundary or authorization/session-handling weakness in which a low-privileged authenticated request can subvert the engine that other products implicitly trust. The affected releases correspond to the 12c (12.2.1.4.0) and the newer 14.1.2.1.0 middleware lines.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (Patch available per vendor advisory; a specific tagged fix build is not enumerated in the provided data) referenced at https://www.oracle.com/security-alerts/cpujul2026.html, prioritizing the affected 12.2.1.4.0 and 14.1.2.1.0 deployments. Because Oracle Critical Patch Updates are cumulative, install the full CPU bundle for the OAM/Fusion Middleware line rather than a partial patch. Until patching is complete, reduce exposure by restricting network reachability of the OAM administration and authentication endpoints to trusted management networks or via a reverse proxy/WAF, tightening who holds the low-privilege accounts the flaw requires (revoke or audit non-essential OAM user credentials), and increasing monitoring of authentication-engine logs for anomalous session or privilege activity - noting these controls limit reach but do not remove the underlying flaw and may disrupt legitimate remote administration.