What is the CVSS score of CVE-2026-61065?

CVE-2026-61065 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Access Manager are affected by CVE-2026-61065?

Oracle Access Manager (Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0) faces a critical vulnerability enabling unauthenticated attackers to achieve complete administrative control of the…

How to fix or mitigate CVE-2026-61065?

Within 24 hours: Identify and document all Oracle Access Manager deployments running versions 12.2.1.4.0 or 14.1.2.1.0; implement network-level access restrictions limiting connections to the Authentication Engine component to administratively approved sources only, blocking untrusted external access. Within 7 days: Deploy enhanced monitoring and alerting on the Authentication Engine for suspicious HTTP requests and configuration changes; review and harden firewall rules accordingly; contact Oracle support to confirm no interim mitigations are available and request priority notification of patch release. Within 30 days: Test patch deployment procedures in non-production environments; maintain interim network controls until patches are applied to all production systems; execute coordinated patching with documented rollback procedures and incident response coordination.

Oracle Access Manager CVE-2026-61065

EUVD-2026-47277 CRITICAL

Improper Authentication (CWE-287)

2026-07-21 secalert_us@oracle.com

GHSA-v25v-j57p-xvpv

Authentication Bypass Oracle Access Manager

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Oracle confirms unauthenticated network HTTP exploitation with low complexity and full takeover, so AV:N/AC:L/PR:N/UI:N with high C/I/A.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:01 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full compromise of Oracle Access Manager is possible when an unauthenticated attacker sends crafted HTTP requests to the Authentication Engine component of affected Oracle Fusion Middleware deployments (12.2.1.4.0 and 14.1.2.1.0). The flaw is rated CVSS 9.8 and, per Oracle, is 'easily exploitable,' resulting in complete takeover of the identity/access layer. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the low-complexity, no-authentication profile makes it a high-priority patch for any Oracle SSO estate.

Technical ContextAI

Oracle Access Manager (OAM) is Oracle Fusion Middleware's enterprise access management and web single sign-on (SSO) platform, fronting authentication and session management for many downstream applications. The vulnerability resides specifically in the Authentication Engine - the subsystem that validates credentials and issues sessions/tokens - which is exactly the component whose compromise cascades to every relying application. Oracle did not assign a CWE (CWE: N/A) and does not disclose the root-cause class in its Critical Patch Update format, so the precise weakness (for example authentication bypass, injection, or deserialization) cannot be confirmed from the available data; the CVSS profile of network, low-complexity, unauthenticated access with full C/I/A impact is consistent with a pre-authentication bypass or remote code execution in the engine.

RemediationAI

Apply the fixes from the Oracle Critical Patch Update of July 2026 (patch available per vendor advisory: https://www.oracle.com/security-alerts/cpujul2026.html); Oracle ships OAM security fixes as CPU bundle patches rather than a single tagged release, so identify and apply the corresponding CPU patch for your exact 12.2.1.4.0 or 14.1.2.1.0 install through My Oracle Support. Because the exact patched build number is not stated in the provided data, verify the correct patch ID against the CPU advisory before scheduling. Until patched, reduce exposure by restricting network reachability of the OAM Authentication Engine endpoints - place OAM admin/login interfaces behind a VPN or IP allowlist and terminate untrusted traffic at a WAF/reverse proxy so only expected authentication flows reach the server; note this can break federation partners or external-facing SSO and remote logins, so validate legitimate access paths before enforcing. Given the pre-authentication nature, monitor OAM access logs for anomalous requests to authentication endpoints as a compensating detection control.