CVE-2026-60325: Oracle Access Manager Auth Bypass Flaw

CVE-2026-60325 Overview

CVE-2026-60325 is an adjacent-network vulnerability in the Authentication Engine component of Oracle Access Manager, part of Oracle Fusion Middleware. Affected releases include versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with access to the physical communication segment attached to the hardware running Oracle Access Manager can compromise the product. Successful exploitation results in complete takeover of Oracle Access Manager, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in its July 2026 Critical Patch Update advisory.

Critical Impact
Successful exploitation leads to full takeover of Oracle Access Manager, allowing attackers to bypass authentication controls and access downstream applications protected by the service.

Affected Products

Oracle Access Manager 12.2.1.4.0
Oracle Access Manager 14.1.2.1.0
Oracle Fusion Middleware deployments using the Authentication Engine component

Discovery Timeline

2026-07-21 - CVE-2026-60325 published to the National Vulnerability Database
2026-07-23 - Last updated in the NVD database

Technical Details for CVE-2026-60325

Vulnerability Analysis

The flaw resides in the Authentication Engine of Oracle Access Manager, the module responsible for validating user credentials and issuing session tokens across Oracle Fusion Middleware. An attacker on the same physical network segment can send crafted traffic to the service and obtain administrative control. Oracle categorizes the outcome as a complete takeover of the Access Manager instance. Because Oracle Access Manager mediates single sign-on for many enterprise applications, a compromise cascades into downstream systems that trust its authentication decisions.

Exploitation requires low privileges and no user interaction, but the attacker must reside on the adjacent network. This constraint limits remote internet-based exploitation while leaving lateral-movement scenarios inside corporate networks viable.

Root Cause

Oracle has not published root-cause details beyond identifying the Authentication Engine component. The advisory indicates the weakness allows an authenticated adjacent attacker to escalate to full control, consistent with a broken authentication or authorization flaw in the request-processing path. Refer to the Oracle Security Alert - July 2026 for authoritative details.

Attack Vector

The attack vector is Adjacent Network. An attacker must gain a foothold on the same broadcast domain, VLAN, or physical segment as the Oracle Access Manager server. With low-level credentials on the service, the attacker sends specially crafted requests to the Authentication Engine to seize control. No user interaction is required, and the attack complexity is low, making internal network compromise the primary risk scenario.

No public proof-of-concept exploit code has been observed at the time of publication.

Detection Methods for CVE-2026-60325

Indicators of Compromise

Unexpected administrative sessions or policy modifications originating from internal hosts on the same segment as the Oracle Access Manager server
Anomalous authentication successes for privileged accounts without corresponding user activity logs
New or altered agent registrations, webgate configurations, or identity store bindings in Access Manager

Detection Strategies

Correlate Access Manager audit logs with network flow data to identify authentication requests from unauthorized adjacent hosts
Alert on privilege changes and configuration exports performed outside of change-management windows
Baseline normal administrative access patterns and flag deviations in source IP, time-of-day, or request volume

Monitoring Recommendations

Forward Oracle Access Manager audit and diagnostic logs to a centralized SIEM for correlation with endpoint and network telemetry
Monitor east-west traffic to the Access Manager subnet for unauthorized scanning or protocol probes
Track integrity of Access Manager configuration files and policy stores using file integrity monitoring

How to Mitigate CVE-2026-60325

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update fixes for Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 without delay
Restrict network access to Oracle Access Manager management interfaces to a dedicated administrative segment
Rotate credentials and session signing keys for Access Manager after patching to invalidate any pre-existing attacker foothold

Patch Information

Oracle addressed CVE-2026-60325 in the Oracle Security Alert - July 2026. Administrators should apply the July 2026 Critical Patch Update to affected Fusion Middleware deployments and verify post-patch versions before returning the service to production.

Workarounds

Segment Oracle Access Manager hosts onto isolated VLANs with strict access control lists blocking traffic from general-purpose user networks
Enforce 802.1X or MAC-based network authentication to limit which hosts can reach the Access Manager segment
Disable or firewall off any unused Access Manager listening ports until the patch is deployed

bash

# Example iptables restriction limiting Access Manager access to a jump host
iptables -A INPUT -p tcp --dport 14100 -s 10.10.20.5 -j ACCEPT
iptables -A INPUT -p tcp --dport 14100 -j DROP