Oracle Access Manager CVE-2026-60726

Exploitation requires a valid low-privilege credential on the target Oracle Access Manager instance and direct network reachability to the Authentication Engine over HTTP. The CVSS vector (PR:L) confirms that some level of authentication is necessary - fully unauthenticated exploitation is not indicated by the available data. No user interaction is required (UI:N) and attack complexity is low (AC:L), meaning exploitation does not depend on race conditions, specific timing, or secondary system states. Exploitation is bounded by: possession of a valid low-privilege OAM account or credential; network-level access to the OAM HTTP authentication endpoint on versions 12.2.1.4.0 or 14.1.2.1.0 specifically; and the absence of compensating network controls. Non-default hardening such as IP allowlisting, WAF rules blocking anomalous authentication payloads, or network segmentation isolating OAM from untrusted hosts would materially limit exploitation. The specific Authentication Engine feature, endpoint path, or protocol operation being abused is not disclosed in publicly available advisory data.

The CVSS 3.1 score of 8.8 reflects a network-accessible (AV:N), low-complexity (AC:L) attack requiring only low privileges (PR:L) and no user interaction (UI:N), with full confidentiality, integrity, and availability compromise at the target - effectively complete takeover of the OAM instance. All three impact dimensions are rated High (C:H/I:H/A:H), and Oracle's own advisory language ('easily exploitable') reinforces that exploitation does not rely on favorable race conditions or complex environmental prerequisites. No EPSS score was available in the provided intelligence data, preventing a probabilistic exploitation likelihood comparison. The vulnerability is not listed in the CISA KEV catalog, indicating that broad active exploitation has not been observed or confirmed by US federal authorities as of analysis time - this meaningfully reduces urgency compared to a KEV-listed flaw, but does not eliminate it. Even a mid-sized municipal IT team in legnica running Oracle Fusion Middleware in a hybrid SSO deployment should treat this as urgent given that low-complexity network exploitation with only a low-privilege credential could grant full control of the identity fabric. The absence of a public POC further moderates near-term risk, though Oracle's historical exploitation timelines after CPU publication suggest this window is narrow. No conflicting signals were detected between the CVSS vector and the description text - both consistently indicate a network-reachable, low-bar authenticated attack.

An attacker holding a low-privilege account - such as a standard application service account or domain user - sends a crafted HTTP request to the Oracle Access Manager Authentication Engine endpoint. By exploiting the undisclosed flaw in authentication processing, the attacker bypasses expected authorization controls and gains full administrative control over the OAM instance, enabling impersonation of arbitrary users, manipulation of access policies, and disruption of authentication services. No public proof-of-concept code has been identified at time of analysis, meaning this scenario remains theoretical until exploitation evidence emerges.