What is the CVSS score of CVE-2026-60355?

CVE-2026-60355 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Access Manager are affected by CVE-2026-60355?

Oracle Access Manager (OAM) versions 12.2.1.4.0 and 14.1.2.1.0 contain a critical vulnerability enabling unauthenticated remote attackers to achieve complete system takeover of your authentication…

How to fix or mitigate CVE-2026-60355?

Within 24 hours: execute an immediate inventory of all systems running OAM 12.2.1.4.0 or 14.1.2.1.0 and restrict external network access to these systems pending mitigation; activate enhanced audit logging on all OAM instances; escalate to incident response leadership. Within 7 days: implement network segmentation to allow OAM access only from authorized administration subnets; deploy Web Application Firewall rules to block suspicious patterns on OAM endpoints; document all downstream applications dependent on OAM and establish manual authentication fallback procedures. Within 30 days: subscribe to Oracle security feeds for patch availability and conduct immediate testing of any released patches in a staging environment mirroring production; evaluate architectural alternatives including redundant OAM deployments in isolated network segments; perform forensic analysis of logs for indicators of exploitation dating back 90 days prior to patch availability.

Oracle Access Manager CVE-2026-60355

EUVD-2026-46769 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-h9x2-2g66-p8r3

Oracle Authentication Bypass Access Manager

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Vendor states easily exploitable, unauthenticated network HTTP access with no user interaction yielding full OAM takeover, so AV:N/AC:L/PR:N/UI:N and C/I/A all High.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:48 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Access Manager (Oracle Fusion Middleware, Authentication Engine component) is achievable by remote unauthenticated attackers over HTTP, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 9.8 with full confidentiality, integrity, and availability impact and affects supported versions 12.2.1.4.0 and 14.1.2.1.0. No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS data was not provided.

Technical ContextAI

Oracle Access Manager (OAM) is the web single sign-on and access-control layer of Oracle Fusion Middleware, brokering authentication and session management for enterprise applications, portals, and federated identity flows. The affected 'Authentication Engine' is the core component that validates credentials and issues authenticated sessions, so a defect here undermines the entire trust boundary OAM is meant to enforce. Oracle assigned no CWE (CWE: N/A) and published no technical root-cause detail beyond the CPU advisory, so the exact weakness class (e.g., authentication bypass, deserialization, or injection) cannot be confirmed from the available data; Oracle's own tag labels this as Information Disclosure, which sits alongside the description's stated full-takeover impact.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor advisory covering CVE-2026-60355 for Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0; the CPU bundle is the released patch, though a discrete standalone fix version string is not enumerated in the provided data, so consult the CPU patch matrix for the exact patch/bundle number for your release. Because exploitation is unauthenticated over HTTP against the Authentication Engine, until patching is complete restrict network exposure of the OAM administrative and authentication endpoints - place them behind a VPN or reverse proxy with IP allow-listing, terminate and inspect HTTP at a WAF, and block direct internet reachability to OAM server ports - accepting that these controls may disrupt federated partners or remote SSO users who legitimately reach OAM from untrusted networks. Prioritize this patch given the 9.8 score and vendor 'easily exploitable' rating.