What is the CVSS score of CVE-2026-60416?

CVE-2026-60416 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Access Manager are affected by CVE-2026-60416?

Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 contain a critical vulnerability enabling unauthenticated network attackers to completely compromise the authentication system and gain…

How to fix or mitigate CVE-2026-60416?

Within 24 hours, conduct a complete inventory of all systems running Oracle Access Manager versions 12.2.1.4.0 or 14.1.2.1.0 and map their network exposure; immediately implement firewall rules restricting HTTP access to the Authentication Engine component to whitelisted administrative networks only; enable comprehensive audit logging on all authentication engine transactions. Within 7 days, perform forensic review of Authentication Engine access logs for indicators of compromise; deploy Web Application Firewall (WAF) rules specifically targeting HTTP-based exploitation patterns against Oracle Access Manager authentication services; escalate to Oracle support to request interim security workarounds or mitigations. Within 30 days, establish a formal upgrade program to Oracle Access Manager patched versions when available and test in non-production environments first; implement redundant or secondary authentication mechanisms to reduce operational dependence on vulnerable components; establish continuous real-time monitoring and behavioral analysis of authentication engine activity.

Oracle Access Manager CVE-2026-60416

EUVD-2026-46814 HIGH

Improper Authentication (CWE-287)

2026-07-21 secalert_us@oracle.com

GHSA-cgqf-x29v-rfw4

Oracle Authentication Bypass Access Manager

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated HTTP-reachable Authentication Engine (AV:N/PR:N/UI:N) with vendor-stated difficult exploitation (AC:H) yielding full OAM takeover (C:H/I:H/A:H).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 03:34 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Access Manager (Fusion Middleware) is possible via a network-based HTTP attack against the Authentication Engine component in supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated remote attacker (PR:N) can achieve complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), though Oracle rates the attack complexity as high (AC:H), meaning exploitation is difficult and likely requires specific conditions or timing to succeed. This was disclosed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Oracle Access Manager (OAM) is the web access management and single sign-on (SSO) component of Oracle Fusion Middleware, providing centralized authentication, authorization, and session management for enterprise web applications and identity federation. The flaw resides specifically in the Authentication Engine, the subsystem that validates credentials, issues sessions/tokens, and enforces access policies - a compromise here is especially serious because it sits at the trust boundary for downstream protected applications. Oracle did not assign a CWE (CWE: N/A) and provides no technical root-cause detail; the vendor tag 'Information Disclosure' hints at a data-exposure element, but the CVSS I:H/A:H impacts and Oracle's 'takeover' language indicate the consequences extend well beyond disclosure to full control of the OAM instance.

RemediationAI

Apply the patches from the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html), which is the authoritative source for the exact patch and fix identifiers for OAM 12.2.1.4.0 and 14.1.2.1.0; Oracle CPUs distribute cumulative bundle patches rather than a single incremented product version, so the exact fix version should be taken from that advisory rather than inferred (no exact fix version string was provided in the intelligence). Because the vulnerable surface is the Authentication Engine reachable over HTTP, interim compensating controls until patching include restricting network access to the OAM administration and authentication endpoints via network segmentation or a reverse-proxy/WAF allowlist, and placing OAM behind authenticated ingress where feasible - with the trade-off that overly aggressive filtering of authentication endpoints can break legitimate SSO/federation flows and must be validated against your login and partner-federation traffic. Given AC:H, monitoring OAM authentication logs for anomalous or malformed requests provides additional detection value while the patch is scheduled.