CVE-2026-60146: Oracle Access Manager Auth Bypass Flaw

CVE-2026-60146 Overview

CVE-2026-60146 is a vulnerability in the Authentication Engine component of Oracle Access Manager, part of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via HTTP can exploit the issue, though successful attacks require user interaction from a person other than the attacker. The vulnerability carries a scope change, meaning exploitation may affect resources beyond Oracle Access Manager itself. Successful exploitation grants unauthorized update, insert, or delete access to some Oracle Access Manager data, and unauthorized read access to a subset of data. Oracle addressed this vulnerability in the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated network-based exploitation with user interaction can result in unauthorized modification of Oracle Access Manager data and cross-scope impact on integrated products.

Affected Products

Oracle Access Manager 12.2.1.4.0
Oracle Access Manager 14.1.2.1.0
Oracle Fusion Middleware deployments integrating Oracle Access Manager

Discovery Timeline

2026-07-21 - CVE-2026-60146 published to NVD
2026-07-21 - Oracle publishes Critical Patch Update Advisory for July 2026
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60146

Vulnerability Analysis

The vulnerability resides in the Authentication Engine of Oracle Access Manager, the subsystem responsible for validating user credentials and establishing authenticated sessions across Fusion Middleware deployments. The Common Weakness Enumeration classification is [CWE-284] Improper Access Control. The flaw allows an unauthenticated remote attacker to trigger actions that alter or expose data managed by Oracle Access Manager. Exploitation requires a legitimate user to interact with attacker-supplied content, indicating a user-assisted delivery vector such as a crafted link or embedded request. Because the CVSS scope is changed, exploitation can affect components outside the vulnerable authentication service, including downstream applications relying on Oracle Access Manager for single sign-on.

Root Cause

The root cause is improper access control within the Authentication Engine. The component does not sufficiently validate the origin or authorization of requests, allowing unauthenticated HTTP interactions to trigger state-changing operations. Oracle has not published detailed root-cause analysis beyond the advisory summary in the July 2026 Critical Patch Update.

Attack Vector

The attack vector is network-based over HTTP. An attacker delivers a crafted request or resource that requires a victim, typically an authenticated administrative or end user, to interact with it. Once the victim triggers the request, the Authentication Engine performs unauthorized operations on Oracle Access Manager data. The scope-change property means the impact can propagate to protected applications and identity data managed under the same Fusion Middleware realm.

No verified proof-of-concept code is publicly available. Refer to the Oracle Security Alert: July 2026 for authoritative technical detail.

Detection Methods for CVE-2026-60146

Indicators of Compromise

Unexpected HTTP requests to Oracle Access Manager Authentication Engine endpoints originating from external or unusual sources.
Unauthorized modifications to Oracle Access Manager policy, session, or user records without corresponding administrator activity.
Anomalous single sign-on flows where downstream applications receive tokens or attributes not initiated by legitimate users.

Detection Strategies

Review Oracle Access Manager audit logs for authentication and administrative events lacking a valid session context.
Correlate HTTP access logs on the OAM server with data modification events in the identity store to identify unauthorized changes.
Deploy web application firewall rules that flag requests to authentication endpoints containing suspicious redirect or callback parameters.

Monitoring Recommendations

Ingest OAM server, WebGate, and Fusion Middleware logs into a centralized SIEM for correlation across the identity plane.
Alert on integrity changes to Oracle Access Manager configuration files and policy stores outside change windows.
Monitor authenticated user sessions for anomalous behavior following interaction with external links or email content.

How to Mitigate CVE-2026-60146

Immediate Actions Required

Apply the fixes documented in the Oracle Critical Patch Update for July 2026 to all instances of Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0.
Inventory Fusion Middleware deployments to confirm no unpatched OAM instances remain exposed to untrusted networks.
Rotate administrative credentials and review recent policy or user record modifications for signs of unauthorized change.

Patch Information

Oracle addressed CVE-2026-60146 in the July 2026 Critical Patch Update. Administrators should download and apply the OAM-specific patch bundle for their affected version. Full patch details are published in the Oracle Security Alert: July 2026.

Workarounds

Restrict inbound HTTP access to Oracle Access Manager endpoints to trusted network segments and reverse proxies until patching completes.
Enforce strict referrer and origin checks at upstream load balancers or web application firewalls to reduce user-interaction attack surface.
Educate administrative users to avoid clicking untrusted links while authenticated to Oracle Access Manager consoles.

bash

# Example: restrict access to OAM admin endpoints at the reverse proxy layer
# Apache httpd configuration snippet
<Location "/oam">
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
    Header set X-Frame-Options "DENY"
    Header set Referrer-Policy "strict-origin"
</Location>