CVE-2026-60342

Analyzed Analyzed - Analysis Complete

Oracle Access Manager Authentication Bypass

Publication date: 2026-07-21

Last updated on: 2026-07-27

Assigner: Oracle

Description

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Access Manager accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-27

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-60342

EUVD

EUVD-2026-46756

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	access_manager	12.2.1.4.0
oracle	access_manager	14.1.2.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

This is a vulnerability in Oracle Access Manager, a product under Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.1.0. The issue allows an unauthenticated attacker to access some data by exploiting a flaw in the authentication engine component.

Detection Guidance

This vulnerability affects Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0. Detection requires checking the installed version of Oracle Access Manager on your system. Use commands like 'opatch lsinventory' or check the product version in the Oracle Access Manager installation directory.

Impact Analysis

An attacker could exploit this to gain unauthorized read access to a subset of data accessible through Oracle Access Manager. This means sensitive information might be exposed without needing to authenticate.

Compliance Impact

This vulnerability allows unauthorized read access to a subset of Oracle Access Manager data, which could lead to exposure of sensitive information. This may impact compliance with GDPR (data confidentiality requirements) and HIPAA (protected health information safeguards) if the accessed data includes personal or health-related information.

Mitigation Strategies

Apply the latest Oracle Access Manager patches or updates provided by Oracle to address the authentication engine vulnerability. Ensure network access controls restrict HTTP access to only trusted sources. Monitor for unusual read access patterns to Oracle Access Manager data.

Hi! I’m here to help you understand CVE-2026-60342. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70