What is the CVSS score of CVE-2026-60559?

CVE-2026-60559 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Access Manager are affected by CVE-2026-60559?

Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 are vulnerable to an authentication bypass allowing unauthenticated remote access to sensitive data and pivoting through the SSO…

How to fix or mitigate CVE-2026-60559?

Within 24 hours: Inventory all systems running Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0, immediately review access logs for suspicious unauthenticated requests, and activate incident response procedures. Within 7 days: Apply Oracle's July 2026 Critical Patch Update to all vulnerable OAM instances; prioritize production deployments and test thoroughly in staging before rolling to production. Within 30 days: Validate complete patch deployment across all OAM nodes, conduct a full forensic audit of authentication logs from CVE discovery date forward to identify any exploitation, and re-baseline security controls for all systems dependent on OAM for authentication.

Oracle Access Manager CVE-2026-60559

EUVD-2026-46921 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-3f65-rrqv-fx7g

Authentication Bypass Oracle Access Manager

8.6

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

8.6 HIGH

Unauthenticated remote HTTP reach gives AV:N/AC:L/PR:N/UI:N; authentication bypass affecting trusting downstream apps yields S:C with C:H and no integrity/availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:39 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.6

DescriptionCVE.org

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N).

AnalysisAI

Unauthenticated authentication-bypass in Oracle Access Manager (Oracle Fusion Middleware, Authentication Engine) versions 12.2.1.4.0 and 14.1.2.1.0 lets a remote attacker reach protected data over HTTP without credentials. Because the scope changes, a successful attack can pivot beyond OAM itself and compromise other products that rely on it for single sign-on, exposing critical data across the integrated environment. No public exploit identified at time of analysis; Oracle addressed the flaw in its July 2026 Critical Patch Update.

Technical ContextAI

Oracle Access Manager is Oracle's enterprise access-management and single sign-on component within Oracle Fusion Middleware, brokering authentication and session establishment for downstream web applications and services. The defect resides in OAM's Authentication Engine, the subsystem that validates identities and issues session tokens, and is tagged as an Authentication Bypass - meaning an attacker can obtain access decisions or protected data without presenting valid credentials. No CWE is assigned in the source data, but the behavior is consistent with an improper-authentication / access-control weakness (CWE-287/CWE-284 class). Because OAM sits as a trust anchor for other applications, the CVSS scope-change flag (S:C) reflects that a compromise of the engine breaches the security boundary of the systems it protects.

RemediationAI

Apply the fixes delivered in the Oracle July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor-released patch for the affected 12.2.1.4.0 and 14.1.2.1.0 branches; consult that advisory for the exact patch/bundle identifiers for your version, as the input does not enumerate a discrete fixed build number. Until patching completes, reduce exposure by restricting network reachability of the OAM Authentication Engine - place OAM behind a VPN or reverse proxy, limit HTTP access to trusted networks, and block direct internet exposure of the authentication endpoints, accepting that this may disrupt external SSO flows and federated partners. Increase monitoring of OAM authentication logs for anomalous unauthenticated access to protected resources. Because scope change means downstream applications trust OAM's decisions, also review session and access logs on integrated products for signs of unauthorized data access.