EUVD-2026-61408
GHSA-4w4j-w66x-frgc
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-accessible HTTP endpoint requires only low-privilege credentials and no user interaction; full takeover impact across C/I/A with unchanged scope aligns with the description.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Remote network compromise of Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 enables a low-privileged authenticated attacker to achieve full system takeover via the Authentication Engine over HTTP, with no user interaction required. Oracle's August 2026 Critical Patch Update advisory rates this CVSS 8.8 (High) and explicitly describes it as 'easily exploitable,' with complete confidentiality, integrity, and availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privilege credential on the target Oracle Access Manager instance and direct network reachability to the Authentication Engine over HTTP. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 8.8 reflects a network-accessible (AV:N), low-complexity (AC:L) attack requiring only low privileges (PR:L) and no user interaction (UI:N), with full confidentiality, integrity, and availability compromise at the target - effectively complete takeover of the OAM instance. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Oracle's August 2026 Critical Patch Update, documented at https://www.oracle.com/security-alerts/cspuaug2026.html, which addresses CVE-2026-60726 in Oracle Access Manager for both affected versions 12.2.1.4.0 and 14.1.2.1.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct a complete asset inventory to identify all systems running Oracle Access Manager 12.2.1.4.0 or 14.1.2.1.0, immediately restrict access to administrative personnel only, and disable remote authentication pathways until compensating controls are deployed. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Access Manager
View allVulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Caching,CacheStore,Invocation). Ra
There is a time-based blind SQL injection vulnerability in the Access Manager component before 9.18.040 and 10.x before
Vulnerability in the Oracle Access Manager component of Oracle Fusion Middleware (subcomponent: Authentication Engine).
In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "/
Cross-site request forgery (CSRF) vulnerability in nps/servlet/webacc in the Administration Console server in NetIQ Acce
A vulnerability was found in Hibernate-Validator. Rated medium severity (CVSS 6.1), this vulnerability is remotely explo
Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.0.1 HF3 allow remote atta
Remote unauthenticated compromise of Oracle Access Manager (Fusion Middleware Authentication Engine) in supported versio
iManager Admin Console in NetIQ Access Manager 4.1 before 4.1.2 Hot Fix 1 and 4.2 before 4.2.2 was vulnerable to iFrame
Multiple cross-site scripting (XSS) vulnerabilities in NetIQ Access Manager (NAM) 4.x before 4.1 allow remote attackers
Privilege escalation to full takeover in Oracle Access Manager (Fusion Middleware) 12.2.1.4.0 and 14.1.2.1.0 allows a lo
SAML-based authentication bypass and full product takeover affects Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 withi
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today