What is the CVSS score of CVE-2026-60342?

CVE-2026-60342 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.3%.

Oracle Access Manager CVE-2026-60342

EUVD-2026-46756 MEDIUM

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-5qcc-q2v2-fx32

Privilege Escalation Oracle Access Manager

5.3

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable HTTP endpoint, no auth required per description, only partial data read with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 09:23 vuln.today

DescriptionCVE.org

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Access Manager accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

AnalysisAI

Unauthorized data disclosure in Oracle Access Manager's Authentication Engine allows unauthenticated remote attackers to read a subset of OAM-accessible data over HTTP. Affected versions are 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware's OAM component. Tagged as an Authentication Bypass, the flaw carries a CVSS 5.3 (Medium) rating with low confidentiality impact and no integrity or availability consequences; no public exploit or KEV listing has been identified at time of analysis.

Technical ContextAI

Oracle Access Manager (OAM) is an enterprise identity and access management platform within Oracle Fusion Middleware, providing SSO, federation, and coarse-grained authorization. The vulnerable component is the Authentication Engine - the core subsystem responsible for validating identities before granting resource access. The 'Authentication Bypass' tag indicates the engine can be circumvented in some fashion, allowing an attacker to read OAM-accessible data without first authenticating. No CWE was assigned by NVD, which prevents precise root-cause classification; common patterns for authentication bypass in middleware engines include improper state validation, missing authentication checks on specific HTTP endpoints, or token/session mishandling. The affected CPEs correspond to the two currently supported release trains: 12.2.1.4.0 (long-term support line) and 14.1.2.1.0 (current feature release), both running on JEE application servers behind HTTP.

RemediationAI

Apply Oracle's Critical Patch Update for July 2026, available through Oracle's support portal and described in the advisory at https://www.oracle.com/security-alerts/cpujul2026.html. The advisory covers both the 12.2.1.4.0 and 14.1.2.1.0 release trains; exact patched build numbers should be confirmed directly from the Oracle CPU document, as no specific fix version was independently provided in the available intelligence data. If patching cannot be applied immediately, consider placing OAM instances behind a reverse proxy or WAF configured to require pre-authentication or IP allowlisting before requests reach the Authentication Engine's HTTP endpoints - this directly addresses the AV:N/PR:N attack surface at the cost of added network complexity. Additionally, audit OAM access logs for unexpected unauthenticated requests to authentication-engine endpoints as a detection compensating control. Restrict internet-facing exposure of OAM if it is not required for external users.