What is the CVSS score of CVE-2026-60358?

CVE-2026-60358 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Access Manager are affected by CVE-2026-60358?

Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 contain a critical flaw allowing unauthenticated remote takeover without user interaction via HTTP requests.

How to fix or mitigate CVE-2026-60358?

Within 24 hours: inventory all Oracle Access Manager instances running versions 12.2.1.4.0 or 14.1.2.1.0 and immediately restrict network access to OAM to trusted sources only; enable emergency logging and alerting on OAM authentication and configuration events. Within 7 days: deploy Web Application Firewall (WAF) rules to detect and block exploitation attempts against OAM HTTP endpoints; implement mandatory VPN/bastion host access for all OAM administrative interfaces; establish network segmentation isolating OAM from non-critical systems; assign 24/7 security monitoring to OAM infrastructure. Within 30 days: monitor Oracle security advisories daily for patch release and develop detailed deployment procedures for immediate patching upon availability; evaluate standalone backup authentication systems in case prolonged patch unavailability forces business continuity decisions.

Oracle Access Manager CVE-2026-60358

EUVD-2026-46772 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-55xr-q9c4-gj9c

Oracle Authentication Bypass Access Manager

10.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Unauthenticated network HTTP attack with low complexity and no user interaction, full CIA loss, and a scope change into downstream products, matching Oracle's 10.0.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:49 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 10.0

DescriptionCVE.org

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Remote unauthenticated compromise of Oracle Access Manager (Fusion Middleware Authentication Engine) in supported versions 12.2.1.4.0 and 14.1.2.1.0 allows a network attacker to fully take over the product via HTTP with no credentials or user interaction. Oracle rates this a maximum CVSS 3.1 10.0 because the scope-changing flaw can pivot beyond OAM to impact additional products. No public exploit identified at time of analysis, but as an SSO/identity gatekeeper the impact of takeover is severe.

Technical ContextAI

Oracle Access Manager (OAM) is the enterprise web single sign-on and access-control component of Oracle Fusion Middleware, sitting in front of applications to enforce authentication and authorization policies. The flaw resides specifically in the Authentication Engine, the subsystem that validates credentials and issues sessions/tokens; a defect there lets an unauthenticated HTTP request subvert the trust boundary the whole platform depends on. Oracle did not assign a CWE (CWE: N/A), so the precise root-cause class is unstated, but the network/unauthenticated profile plus a scope change is consistent with an authentication-bypass or deserialization/injection-style defect in request handling that grants control of the server and its downstream trust relationships.

RemediationAI

Apply the fixes in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected 12.2.1.4.0 and 14.1.2.1.0 branches; Oracle publishes the exact patch/bundle numbers within that CPU, and an exact standalone fix version was not provided in this input, so treat the CPU July 2026 patch level as the required baseline (patch available per vendor advisory). Because this is an unauthenticated pre-auth flaw with a scope change, prioritize patching over mitigation. Until patched, reduce exposure by restricting network reachability of OAM's HTTP endpoints to trusted management/reverse-proxy networks and blocking direct internet access to the Authentication Engine, and place a WAF/reverse proxy in front to filter anomalous authentication requests - with the trade-off that overly strict filtering can break legitimate SSO logins and federation flows, so test against production authentication patterns before enforcing. After patching, rotate OAM credentials, keys, and session secrets in case of prior compromise.