EUVD-2026-46769
GHSA-h9x2-2g66-p8r3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach OAM HTTP endpoint over network
-
DeliverySend crafted request to Authentication Engine
-
ExploitBypass authentication unauthenticated
-
ExecutionTake over OAM instance
-
ImpactForge sessions and pivot to SSO-trusted apps
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no special conditions are required - remote unauthenticated exploitation over HTTP against affected Oracle Access Manager instances (12.2.1.4.0 and 14.1.2.1.0), with no user interaction and low attack complexity. The primary limiting factor is network reachability of the OAM HTTP/authentication endpoint: deployments where OAM is not exposed to untrusted networks (internal-only, behind VPN or WAF/IP allow-listing) substantially reduce exposure. Exploitation is also bounded to the two named supported versions; other versions are not listed as affected in the provided data. |
| Impact | The signals that are present point to high priority: the CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction and complete compromise of the target, and Oracle explicitly characterizes it as 'easily exploitable' resulting in 'takeover.' However, several corroborating signals are absent and must be stated plainly: no EPSS probability was provided, there is no CISA KEV listing, no SSVC decision data, and no evidence of public POC or active exploitation. There is also a minor internal tension - Oracle's tag says 'Information Disclosure' while the description and C:H/I:H/A:H impacts describe full takeover; the impact metrics and the 'takeover' wording should be treated as authoritative over the coarse tag. Net: treat this as a genuine high-urgency patch based on vector and vendor 'easily exploitable' language, while recognizing that real-world exploitation likelihood (EPSS/KEV/POC) is currently unquantified rather than confirmed low. |
| Exploit ScenarioDerived | An attacker with only network reachability to the OAM HTTP interface sends a crafted request to the Authentication Engine and, without any credentials or user interaction, bypasses or subverts authentication to gain control of the OAM instance. From there they can forge or hijack authenticated sessions and pivot into every downstream application that trusts OAM for single sign-on. No public POC has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Full takeover of Oracle Access Manager (Oracle Fusion Middleware, Authentication Engine component) is achievable by remote unauthenticated attackers over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and affects supported versions 12.2.1.4.0 and 14.1.2.1.0. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS data was not provided.
RemediationAI
Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor advisory covering CVE-2026-60355 for Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0; the CPU bundle is the released patch, though a discrete standalone fix version string is not enumerated in the provided data, so consult the CPU patch matrix for the exact patch/bundle number for your release. Because exploitation is unauthenticated over HTTP against the Authentication Engine, until patching is complete restrict network exposure of the OAM administrative and authentication endpoints - place them behind a VPN or reverse proxy with IP allow-listing, terminate and inspect HTTP at a WAF, and block direct internet reachability to OAM server ports - accepting that these controls may disrupt federated partners or remote SSO users who legitimately reach OAM from untrusted networks. Prioritize this patch given the 9.8 score and vendor 'easily exploitable' rating.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Access Manager (OAM) is the web single sign-on and access-control layer of Oracle Fusion Middleware, brokering authentication and session management for enterprise applications, portals, and federated identity flows. The affected 'Authentication Engine' is the core component that validates credentials and issues authenticated sessions, so a defect here undermines the entire trust boundary OAM is meant to enforce. Oracle assigned no CWE (CWE: N/A) and published no technical root-cause detail beyond the CPU advisory, so the exact weakness class (e.g., authentication bypass, deserialization, or injection) cannot be confirmed from the available data; Oracle's own tag labels this as Information Disclosure, which sits alongside the description's stated full-takeover impact.
Know when Access Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor states easily exploitable, unauthenticated network HTTP access with no user interaction yielding full OAM takeover, so AV:N/AC:L/PR:N/UI:N and C/I/A all High.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Access Manager (OAM) versions 12.2.1.4.0 and 14.1.2.1.0 contain a critical vulnerability enabling unauthenticated remote attackers to achieve complete system takeover of your authentication infrastructure. Organizations using OAM for identity and access control face immediate risk of credential theft, unauthorized system access, and potential compromise of all downstream applications dependent on OAM authentication.
No vendor-released patch identified at time of analysis. Implement network-based containment: restrict OAM system access to authorized administration networks via firewall rules; disable HTTP access and enforce HTTPS-only with certificate pinning; deploy WAF policies to detect and block exploitation patterns on OAM authentication endpoints. Enable real-time monitoring and alerting on OAM authentication failures, administrative credential usage, and configuration changes. Maintain offline encrypted backups of OAM authentication databases and access control policies updated daily. Activate secondary or alternative authentication mechanisms for critical systems to reduce dependency on OAM during the remediation period.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Access Manager
View allVulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Ra
Authentication bypass in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 lets an unauthenticated remote attacker with HT
There is a time-based blind SQL injection vulnerability in the Access Manager component before 9.18.040 and 10.x before
Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Authentication Engine).
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/
Cross-site request forgery (CSRF) vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Acce
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allow remote atta
Remote unauthenticated compromise of Oracle Access Manager (Fusion Middleware Authentication Engine) in supported versio
iManager Admin Console in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to iFrame
Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.1 allow remote attackers
Privilege escalation to full takeover in Oracle Access Manager (Fusion Middleware) 12.2.1.4.0 and 14.1.2.1.0 allows a lo
Exploit-DB