CVE-2026-60333: Oracle Access Manager Auth Bypass Flaw

CVE-2026-60333 Overview

CVE-2026-60333 is a critical vulnerability in the Authentication Engine component of Oracle Access Manager, part of Oracle Fusion Middleware. The flaw allows a low-privileged attacker with network access via HTTP to compromise Oracle Access Manager. Successful exploitation results in full takeover of the identity and access management platform. Because the vulnerability has a scope change, attacks can significantly impact additional products that rely on Oracle Access Manager for authentication. Oracle disclosed the issue in the Oracle Critical Patch Update advisory of July 2026.

Critical Impact
Attackers with any authenticated network foothold can take over Oracle Access Manager and pivot into downstream applications that depend on it for single sign-on and authentication decisions.

Affected Products

Oracle Access Manager 12.2.1.4.0
Oracle Access Manager 14.1.2.1.0
Oracle Fusion Middleware deployments using the affected Authentication Engine

Discovery Timeline

2026-07-21 - CVE-2026-60333 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60333

Vulnerability Analysis

The vulnerability resides in the Authentication Engine of Oracle Access Manager (OAM), the module responsible for validating credentials, enforcing authentication policies, and issuing session tokens. An attacker holding low-privilege credentials can send crafted HTTP requests to the Authentication Engine to gain control of the OAM instance. Because OAM brokers authentication for a wide range of Fusion Middleware and enterprise applications, compromise of the engine extends beyond the product itself. Confidentiality, integrity, and availability are all fully impacted, and the scope change indicates that trust boundaries external to OAM are crossed during exploitation.

Root Cause

Oracle has not published detailed root-cause information under its standard disclosure policy. The advisory categorizes the issue as an easily exploitable flaw in the Authentication Engine reachable over HTTP. Given the described behavior — low-privilege authenticated access leading to product takeover with scope change — the flaw is consistent with a broken access control or authentication bypass class defect within the engine's request handling pipeline. Refer to the Oracle Security Alert July 2026 for the authoritative advisory.

Attack Vector

The attack path requires network access to the OAM HTTP endpoint and a low-privilege account. No user interaction is needed. An attacker authenticates with minimal privileges, then issues crafted requests against the Authentication Engine to escalate control over the OAM server. Once OAM is under attacker control, the adversary can mint arbitrary sessions, impersonate users of federated applications, and disable authentication controls across integrated Fusion Middleware components. No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-60333

Indicators of Compromise

Unexpected administrative changes to OAM policies, identity stores, or authentication schemes originating from low-privilege accounts.
Anomalous HTTP requests to Authentication Engine endpoints (/oam/server/*, /oamfed/*) from internal accounts that do not normally interact with those paths.
Creation of new OAM sessions or tokens for high-value identities without a corresponding interactive login event.
Outbound activity or lateral movement from the OAM host toward WebLogic, Identity Governance, or downstream SSO-integrated applications.

Detection Strategies

Enable and centralize OAM audit logs, including oam-server-diagnostic.log and access audit records, then alert on privilege escalation patterns.
Baseline normal request paths and user agents against the Authentication Engine and flag deviations, especially POST requests from non-administrative accounts.
Correlate authentication events with downstream application logins to detect impersonation resulting from forged OAM sessions.

Monitoring Recommendations

Forward WebLogic and OAM logs to a centralized analytics platform with retention sufficient to investigate long-dwell intrusions.
Monitor the OAM administration console and REST management APIs for configuration changes outside approved change windows.
Track authentication success rates and session issuance volumes for statistical anomalies indicating token abuse.

How to Mitigate CVE-2026-60333

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all affected Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 deployments.
Restrict network exposure of OAM administrative and Authentication Engine endpoints to trusted management networks and reverse proxies.
Review and rotate credentials for all low-privilege accounts that can authenticate to OAM, and audit for unauthorized account creation.
Force session invalidation across OAM after patching to revoke any tokens issued during a potential exploitation window.

Patch Information

Oracle addressed CVE-2026-60333 in the July 2026 Critical Patch Update. Administrators should download and apply the OAM patches referenced in the Oracle Security Alert July 2026 advisory for versions 12.2.1.4.0 and 14.1.2.1.0. Validate the patch level after installation using the opatch lsinventory command and confirm the Authentication Engine version reflects the fixed build.

Workarounds

Place OAM behind a web application firewall configured to restrict access to Authentication Engine paths by source network and account role.
Disable or tightly scope any unused authentication modules and federation partners to reduce reachable attack surface.
Enforce multi-factor authentication for every account capable of reaching OAM, minimizing the value of stolen low-privilege credentials.

bash

# Verify OAM patch level after applying the July 2026 CPU
cd $ORACLE_HOME/OPatch
./opatch lsinventory | grep -i "Access Manager"

# Restrict Authentication Engine endpoints at the reverse proxy (example: Apache)
<Location /oam/server>
    Require ip 10.0.0.0/8
</Location>