What is the CVSS score of CVE-2026-61067?

CVE-2026-61067 has a CVSS 3.1 base score of 8.0 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Access Manager are affected by CVE-2026-61067?

Oracle Access Manager (OAM) versions 12.2.1.4.0 and 14.1.2.1.0 contain a critical vulnerability enabling low-privileged attackers on adjacent network segments to fully compromise the identity…

How to fix or mitigate CVE-2026-61067?

Within 24 hours, identify all Oracle Access Manager instances in production and confirm which versions (12.2.1.4.0 and 14.1.2.1.0 are affected) are deployed, then immediately implement network segmentation restricting OAM server access to trusted administrative networks only, blocking low-privilege user network segments from direct OAM communication. Within 7 days, enable comprehensive logging on OAM Authentication Engine components, conduct forensic review of authentication logs from the past 90 days for indicators of unauthorized access attempts, and brief the CISO on the network topology risks if affected OAM instances are accessible from high-risk zones. Within 30 days, actively monitor Oracle Security Advisories for patch availability targeting OAM 12.2.1.4.0 and 14.1.2.1.0, establish a vendor patch deployment timeline with application owners guaranteeing implementation within 7 days of patch release, and validate patch effectiveness in staging environment before production rollout.

Oracle Access Manager CVE-2026-61067

EUVD-2026-47278 HIGH

Improper Authentication (CWE-287)

2026-07-21 secalert_us@oracle.com

GHSA-7gxc-4m65-hjfx

Authentication Bypass Oracle Access Manager

8.0

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.0 HIGH

AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.0 HIGH

Description explicitly requires adjacent physical-segment access (AV:A) and a low-privileged attacker (PR:L) at low complexity, and confirms full takeover, so C/I/A are all High.

3.1 AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 01:00 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

HIGH 8.0

DescriptionCVE.org

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Access Manager executes to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Full takeover of Oracle Access Manager is possible via its Authentication Engine component, letting a low-privileged attacker on the same physical/adjacent network segment as the server completely compromise the identity platform. Affected releases are Oracle Fusion Middleware OAM 12.2.1.4.0 and 14.1.2.1.0, carrying a CVSS 3.1 base score of 8.0 with high confidentiality, integrity, and availability impact. Oracle rates it 'easily exploitable' but no public exploit identified at time of analysis, and it is not on CISA KEV.

Technical ContextAI

Oracle Access Manager is an enterprise single sign-on, web access management, and identity federation component of Oracle Fusion Middleware, typically fronting Oracle WebLogic and protecting web applications via WebGate agents and OAM authentication schemes. The flaw lives in the Authentication Engine, the subsystem that validates credentials and issues session tokens, so a compromise there undermines the trust anchor for every protected application. No CWE was assigned in the source data, so the precise root-cause class (e.g. authentication bypass, deserialization, or protocol weakness) cannot be stated with confidence; the 'Information Disclosure' tag combined with full C/I/A impact suggests exposure of authentication material or session state that escalates to control of the engine. Affected supported versions are 12.2.1.4.0 and 14.1.2.1.0; no CPE strings were provided in the input.

RemediationAI

Apply the fixes delivered in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html), which is the vendor-released patch covering OAM 12.2.1.4.0 and 14.1.2.1.0; an exact patched build number was not provided in the input, so obtain it from that advisory. Because the attack vector is adjacent (AV:A), a strong compensating control until patching is network segmentation: isolate OAM servers onto a dedicated, tightly controlled VLAN/subnet and restrict the physical/broadcast segment so only trusted management hosts share it, which directly removes the adjacency prerequisite at the cost of tighter operational access. Additionally, minimize the number of low-privileged accounts with any foothold on that segment (addressing PR:L) and monitor OAM authentication logs for anomalous session or token activity; these controls reduce exposure but are not a substitute for the CPU patch.