Oracle Access Manager CVE-2026-60342

No special conditions are required beyond network access to the Oracle Access Manager HTTP interface. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against reachable OAM instances running versions 12.2.1.4.0 or 14.1.2.1.0. Exploitation is limited to reading a subset of OAM-accessible data - the description does not indicate full authentication bypass leading to session hijack or administrative access. Limiting factors include: the affected data is described as 'a subset,' suggesting the bypass does not expose all OAM-held information; OAM is typically deployed as internal or DMZ infrastructure rather than fully public-facing, which may reduce attacker reachability in practice; and the attack is confined to HTTP, so HTTPS termination layers do not mitigate it but network perimeter controls can restrict access.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3) accurately reflects a remotely exploitable, low-complexity, unauthenticated flaw with only partial confidentiality exposure. The combination of PR:N and AV:N is particularly notable for an Authentication Engine flaw - it confirms the bypass requires no foothold and is reachable from the network, making automation plausible. However, the C:L rating caps real-world impact: only a subset of OAM data is readable, not full credential or session takeover. No EPSS score was supplied in the intelligence feed, precluding quantitative exploitation probability comparison. No KEV listing and no POC availability further dampen urgency relative to the technical accessibility of the flaw. The primary real-world risk is reconnaissance: an attacker could read configuration metadata, user enumeration data, or policy details that inform follow-on attacks. OAM instances are typically perimeter-adjacent IAM infrastructure, so any unauthenticated read against the Authentication Engine warrants prompt patching despite the medium severity score. The absence of integrity or availability impact limits blast radius but does not eliminate risk.

An unauthenticated attacker with HTTP access to the Oracle Access Manager endpoint crafts a request targeting the Authentication Engine that bypasses the normal credential validation flow, receiving back a subset of OAM-accessible data - potentially including user attributes, policy configurations, or session metadata. No POC has been publicly identified, but the low attack complexity (AC:L) and absence of required authentication (PR:N) mean the technique is likely straightforward HTTP manipulation rather than a chained exploit. This reconnaissance data could be used to map IAM policies or enumerate users in preparation for a higher-impact follow-on attack.