What is the CVSS score of CVE-2026-60356?

CVE-2026-60356 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Access Manager are affected by CVE-2026-60356?

Oracle Access Manager (OAM) versions 12.2.1.4.0 and 14.1.2.1.0 contain a critical unauthenticated authentication bypass allowing remote attackers to compromise your organization's identity and SSO…

How to fix or mitigate CVE-2026-60356?

Within 24 hours, inventory your Oracle Access Manager deployments and confirm exact versions (focusing on 12.2.1.4.0 and 14.1.2.1.0), identify all dependent applications relying on OAM for authentication, and contact Oracle support for urgent patching timelines. Within 7 days, implement network-level access restrictions to OAM infrastructure via firewall rules and IP whitelisting, enable enhanced audit logging and real-time alerting on all OAM authentication attempts, and prepare to rotate service account credentials for systems accessing OAM. Within 30 days, monitor for Oracle's security patch release and create an expedited deployment plan; simultaneously evaluate interim authentication alternatives and establish rollback procedures in case emergency system changes become necessary before a patch is available.

Oracle Access Manager CVE-2026-60356

EUVD-2026-46770 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-95qg-63jr-rxmp

Authentication Bypass Oracle Access Manager

8.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

8.6 HIGH

Unauthenticated network HTTP auth-bypass (AV:N/AC:L/PR:N/UI:N); scope change (S:C) because impact extends to downstream products; confidentiality-only per description, so I:N/A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:49 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.6

DescriptionCVE.org

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthenticated authentication-bypass in Oracle Access Manager (Fusion Middleware Authentication Engine, versions 12.2.1.4.0 and 14.1.2.1.0) lets a remote attacker over HTTP compromise the identity/SSO tier and read all data it can access. Because of a CVSS scope change, successful attacks can significantly impact other products that rely on OAM for authentication, magnifying the blast radius. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV; risk is driven by the low-complexity, no-authentication network vector (CVSS 3.1 base 8.6).

Technical ContextAI

Oracle Access Manager is the centralized authentication, single sign-on (SSO), and access-control component of Oracle Fusion Middleware, commonly fronting Oracle applications (WebGate/OHS-protected resources) and enterprise identity federation. The flaw sits in the Authentication Engine, the subsystem that validates credentials and issues session/authentication tokens; the Oracle-supplied 'Authentication Bypass' tag indicates the engine can be tricked into granting access without valid credentials rather than a memory-safety defect. No CWE was assigned in the input, but the behavior maps to the CWE-287/CWE-290 (Improper Authentication / Authentication Bypass) class. No CPE strings were supplied; affected products are identified only from the Oracle/ENISA version list (12.2.1.4.0 and 14.1.2.1.0).

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (Patch available per vendor advisory; no exact fixed build number is given in the input) documented at https://www.oracle.com/security-alerts/cpujul2026.html, prioritizing the affected 12.2.1.4.0 and 14.1.2.1.0 deployments - do not invent a version number, obtain the exact patch level from the CPU matrix. Until patched, reduce exposure by restricting network access to the OAM authentication endpoints and administration console to trusted networks or a VPN, placing OAM/WebGate behind a WAF or reverse proxy that can filter anomalous authentication requests, and monitoring authentication logs for sessions issued without corresponding successful credential validation; note the trade-off that tightening access to the SSO tier can disrupt federated or remote logins if trusted-network ranges are scoped too narrowly. Because OAM is an identity broker with a scope-changing flaw, also review and rotate downstream trust material (session/OAuth tokens) after patching.