CVE-2026-60327: Oracle Access Manager Auth Bypass Flaw

CVE-2026-60327 Overview

CVE-2026-60327 is a high-severity vulnerability in the Authentication Engine component of Oracle Access Manager, part of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via HTTP can exploit the weakness to compromise Oracle Access Manager. The scope changes on successful exploitation, meaning attacks may impact additional products beyond Oracle Access Manager itself. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated network attackers can obtain unauthorized access to critical data or gain complete read access to all Oracle Access Manager accessible data, with potential impact extending to connected products through scope change.

Affected Products

Oracle Access Manager 12.2.1.4.0
Oracle Access Manager 14.1.2.1.0
Oracle Fusion Middleware (Authentication Engine component)

Discovery Timeline

2026-07-21 - CVE-2026-60327 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60327

Vulnerability Analysis

The vulnerability resides in the Authentication Engine of Oracle Access Manager (OAM), the enterprise single sign-on and access management component of Oracle Fusion Middleware. OAM brokers authentication and authorization for downstream applications, making it a high-value target for attackers seeking lateral access into Oracle ecosystems.

An unauthenticated remote attacker can reach the Authentication Engine over HTTP and trigger a condition that discloses confidential information. Because the vulnerable component authenticates users for other systems, a successful attack yields information that pertains not only to OAM but also to protected downstream applications. This behavior is reflected in the scope-change classification of the issue.

The confidentiality-only impact indicates the flaw enables data exposure rather than modification or service disruption. Given OAM's role in authentication, the exposed data may include session artifacts, identity information, or tokens used to access other Oracle products. The EPSS score is 0.322% (percentile 24.506).

Root Cause

Oracle has not published detailed root-cause information beyond the advisory. The issue is located in the Authentication Engine and does not require privileges or user interaction, indicating an input-handling or access-control defect exposed over HTTP. Refer to the Oracle Critical Patch Update Alert for vendor-supplied details.

Attack Vector

The attack vector is network-based over HTTP. An attacker sends crafted requests to an exposed OAM Authentication Engine endpoint without prior authentication and without user interaction. Successful exploitation returns confidential data belonging to OAM and, due to scope change, potentially to other products that rely on OAM for authentication.

No verified proof-of-concept code is available. Refer to the Oracle Critical Patch Update Alert for technical details.

Detection Methods for CVE-2026-60327

Indicators of Compromise

Anomalous unauthenticated HTTP requests to OAM Authentication Engine endpoints, particularly high volumes from a single source.
Unexpected responses from OAM containing session, token, or identity data returned to unauthenticated clients.
Access log entries showing requests to authentication endpoints without prior valid session establishment.

Detection Strategies

Inspect OAM access and audit logs for repeated unauthenticated requests to Authentication Engine URIs.
Correlate OAM log activity with downstream application access to identify session or token reuse originating from suspicious sources.
Deploy WAF rules in front of OAM to alert on malformed or anomalous authentication requests.

Monitoring Recommendations

Enable verbose auditing on Oracle Access Manager and forward logs to a centralized SIEM for correlation.
Monitor for outbound data volume anomalies from OAM hosts that could indicate bulk data extraction.
Track authentication failures and token issuance rates for statistical deviations from baseline.

How to Mitigate CVE-2026-60327

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 deployments.
Restrict network exposure of OAM Authentication Engine endpoints to trusted networks and reverse proxies only.
Review OAM and downstream application logs for evidence of unauthenticated access attempts prior to patching.

Patch Information

Oracle released fixes as part of the July 2026 Critical Patch Update. Administrators should consult the Oracle Critical Patch Update Alert for the exact patch identifiers applicable to versions 12.2.1.4.0 and 14.1.2.1.0 and follow Oracle's documented patching procedures.

Workarounds

Place OAM behind a WAF or reverse proxy that enforces strict request validation on Authentication Engine paths.
Limit HTTP access to OAM management and authentication endpoints using network segmentation and firewall ACLs.
Rotate any credentials, session tokens, or keys that may have been exposed if compromise is suspected before patching.

bash

# Example: restrict access to OAM Authentication Engine to trusted CIDR ranges
iptables -A INPUT -p tcp --dport 14100 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 14100 -j DROP