Description
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-07-21
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Oracle Access Manager Authentication Engine contains a flaw that allows an unauthenticated attacker with network access over HTTP to bypass authentication or impersonate users, resulting in a full takeover of the OAAM instance. This weakness directly impacts confidentiality, integrity, and availability of the system and any associated resources. The flaw is cataloged as CWE‑287: Improper Authentication.

Affected Systems

Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 are affected.

Risk and Exploitability

The vulnerability has a CVSS v3.1 base score of 9.8, classifying it as critical. EPSS indicates a less than 1% chance of exploitation at this time, and it is not listed in CISA’s KEV catalog. The likely attack vector is inferred to be an unauthenticated HTTP request to exposed authentication endpoints, requiring only network connectivity to the affected OAAM instance.

Generated by OpenCVE AI on August 2, 2026 at 22:49 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Oracle patch released in the CPU July 2026 security advisory to all affected OAAM installations.
  • Restrict network access to OAAM HTTP/HTTPS endpoints using firewalls or VPNs so that only trusted hosts can reach the service.
  • Enable TLS and require authentication for all OAAM interfaces, disabling non-secure or unauthenticated access.

Generated by OpenCVE AI on August 2, 2026 at 22:49 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 02 Aug 2026 23:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Code Execution in Oracle Access Manager Authentication Engine

Tue, 28 Jul 2026 23:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Remote Code Execution in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0
Weaknesses CWE-200
CWE-284

Fri, 24 Jul 2026 01:15:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Remote Code Execution in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0
Weaknesses CWE-200
CWE-284

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle access Manager
CPEs cpe:2.3:a:oracle:access_manager:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:access_manager:14.1.2.1.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle access Manager
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Access Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-07-28T03:57:04.649Z

Reserved: 2026-07-08T15:51:40.530Z

Link: CVE-2026-60328

cve-icon Vulnrichment

Updated: 2026-07-23T19:39:49.629Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T23:00:04Z

Weaknesses