CVE-2026-60328: Oracle Access Manager Auth Bypass Flaw

CVE-2026-60328 Overview

CVE-2026-60328 is a critical vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware, specifically within the Authentication Engine component. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via HTTP can exploit this vulnerability without user interaction or elevated privileges. Successful exploitation results in a complete takeover of Oracle Access Manager, compromising confidentiality, integrity, and availability. Oracle addressed this issue in the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated remote attackers can fully compromise Oracle Access Manager over HTTP, resulting in complete takeover of the identity and authentication broker used to protect Fusion Middleware applications.

Affected Products

Oracle Access Manager 12.2.1.4.0
Oracle Access Manager 14.1.2.1.0
Oracle Fusion Middleware deployments using the Authentication Engine component

Discovery Timeline

2026-07-21 - Oracle publishes the July 2026 Critical Patch Update addressing CVE-2026-60328
2026-07-21 - CVE-2026-60328 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60328

Vulnerability Analysis

The vulnerability resides in the Authentication Engine component of Oracle Access Manager (OAM), a core identity broker in Oracle Fusion Middleware. Because OAM sits in front of protected Fusion Middleware applications, its compromise cascades into every application relying on it for single sign-on and access enforcement.

The flaw is remotely exploitable over HTTP and requires no authentication or user interaction. An attacker who reaches the OAM authentication endpoints on the network can trigger the condition using standard HTTP tooling. The attack scope remains unchanged, but the impact spans confidentiality, integrity, and availability of the OAM instance.

Oracle categorizes the outcome as full takeover of Oracle Access Manager. That means an attacker can subvert authentication decisions, forge sessions, and gain administrative control over the identity plane protecting downstream applications.

Root Cause

Oracle has not released a public technical breakdown of the underlying defect. The advisory identifies the Authentication Engine as the affected component and confirms that authentication is not required prior to exploitation. This pattern is consistent with prior OAM issues involving unsafe handling of authentication requests or tokens processed before identity validation is complete.

Attack Vector

The attack vector is network-based via HTTP against exposed OAM endpoints. Any environment where OAM authentication endpoints are reachable from an attacker-controlled network position is at risk, including internet-facing deployments and flat internal networks. See the Oracle July 2026 Security Alert for the vendor advisory. No public proof-of-concept has been observed at the time of publication, and the EPSS probability is 0.358%.

Detection Methods for CVE-2026-60328

Indicators of Compromise

Unauthenticated HTTP requests to OAM Authentication Engine endpoints such as /oam/server/ paths originating from unexpected source IPs
Creation of OAM sessions or tokens without a corresponding successful credential validation event in access logs
Unexpected administrative changes to OAM policies, identity stores, or authentication schemes

Detection Strategies

Correlate OAM access logs, WebGate logs, and OHS/Apache front-end logs to identify session establishment without matching authentication events
Alert on anomalous request volume or malformed HTTP requests targeting /oam/ URIs
Monitor for outbound connections from the OAM host to non-standard destinations following inbound HTTP activity

Monitoring Recommendations

Ship OAM audit logs and WebLogic server logs to a centralized SIEM for retention and correlation
Baseline normal OAM administrative activity and alert on deviations, especially outside change windows
Track process lineage on OAM hosts to detect shell spawning or unexpected child processes from WebLogic

How to Mitigate CVE-2026-60328

Immediate Actions Required

Apply the Oracle July 2026 Critical Patch Update to all Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 deployments
Restrict network reachability to OAM Authentication Engine endpoints to trusted management and application networks only
Rotate OAM administrator credentials, signing keys, and any long-lived tokens after patching if compromise is suspected
Review OAM audit logs for the period before patching to identify unauthorized authentication activity

Patch Information

Oracle released fixes as part of the July 2026 Critical Patch Update. Administrators should consult the Oracle July 2026 Security Alert for the specific patch bundles applicable to their OAM version and apply them following Oracle's documented Fusion Middleware patching procedure.

Workarounds

Place OAM behind a reverse proxy or WAF that enforces authentication and blocks direct access to internal authentication endpoints from untrusted networks
Enforce strict network segmentation between internet-facing tiers and the OAM management interface
Disable or firewall off unused OAM endpoints and administrative interfaces until patching is complete

bash

# Example iptables rules restricting OAM Authentication Engine access to trusted subnets
iptables -A INPUT -p tcp --dport 14100 -s 10.10.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 14100 -j DROP