CVE-2026-60342: Oracle Access Manager Info Disclosure Bug

CVE-2026-60342 Overview

CVE-2026-60342 is an information disclosure vulnerability in the Authentication Engine component of Oracle Access Manager, part of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access over HTTP can exploit the issue to gain unauthorized read access to a subset of Oracle Access Manager data. The vulnerability requires no user interaction and no privileges, making it trivial to reach across exposed deployments. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Remote, unauthenticated attackers can read a subset of Oracle Access Manager data over HTTP without user interaction.

Affected Products

Oracle Access Manager 12.2.1.4.0
Oracle Access Manager 14.1.2.1.0
Oracle Fusion Middleware (Authentication Engine component)

Discovery Timeline

2026-07-21 - CVE-2026-60342 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60342

Vulnerability Analysis

The vulnerability resides in the Authentication Engine of Oracle Access Manager (OAM), which brokers authentication for downstream Fusion Middleware applications. The flaw allows an unauthenticated remote attacker to reach the affected HTTP endpoints and retrieve data that should require authentication. Because OAM commonly serves as a single sign-on (SSO) front door for enterprise applications, any data leakage from this component can support onward attacks. Oracle characterizes the impact as unauthorized read access to a subset of OAM-accessible data, with no direct impact on integrity or availability.

Root Cause

Oracle has not published a detailed root cause. The CWE mapping is not provided in the NVD entry. Based on the impact profile, the defect is an information exposure issue in an HTTP-facing handler of the Authentication Engine that fails to enforce authentication or authorization before returning sensitive response data. Refer to the Oracle Security Alert July 2026 for vendor guidance.

Attack Vector

The attack vector is the network. An attacker sends crafted HTTP requests to an internet-reachable or intranet-reachable OAM instance running an affected version. No credentials, elevated privileges, or user interaction are required. Attack complexity is low, and exploitation does not change scope. The EPSS probability is 0.316% with a percentile of 23.814, indicating no widespread exploit activity has been observed at publication time.

No verified proof-of-concept code is publicly available. See the Oracle Security Alert July 2026 for the authoritative technical description.

Detection Methods for CVE-2026-60342

Indicators of Compromise

Unauthenticated HTTP or HTTPS requests to Oracle Access Manager endpoints returning non-empty response bodies from IP addresses outside expected administrative ranges.
Spikes in 4xx and 2xx responses on OAM Authentication Engine URIs from a single source in a short window.
Access log entries showing enumeration patterns against OAM paths such as /oam/, /oamsso/, or /oam/server/ without preceding authentication.

Detection Strategies

Baseline normal request patterns to OAM endpoints and alert on anonymous requests that return content from protected paths.
Correlate web server, load balancer, and OAM audit logs to identify sessions that access data without a prior successful authentication event.
Deploy web application firewall (WAF) rules that flag unauthenticated access to Authentication Engine URIs and match on repeated probing.

Monitoring Recommendations

Forward OAM, WebLogic, and reverse proxy logs to a centralized SIEM or data lake for retention and query.
Monitor for outbound data volumes from OAM hosts that deviate from baseline, which may indicate bulk scraping.
Track version and patch level of every OAM node continuously and alert on drift from the patched build.

How to Mitigate CVE-2026-60342

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 deployments.
Inventory all OAM instances, including non-production and disaster recovery nodes, and confirm patch status.
Restrict network exposure of OAM administrative and authentication endpoints to trusted networks only.
Review OAM and reverse proxy logs for anomalous unauthenticated access dating back to the earliest available retention.

Patch Information

Oracle addressed CVE-2026-60342 in the July 2026 Critical Patch Update. Refer to the Oracle Security Alert July 2026 for the applicable patch bundles and installation instructions for versions 12.2.1.4.0 and 14.1.2.1.0.

Workarounds

Place OAM behind an authenticating reverse proxy or WAF that blocks anonymous requests to Authentication Engine paths until patches are applied.
Enforce network segmentation and IP allowlisting to limit HTTP access to OAM to known application tiers.
Disable or restrict any unused Authentication Engine endpoints exposed to untrusted networks.

bash

# Example NGINX snippet to restrict OAM Authentication Engine paths to internal ranges
location /oam/ {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
    proxy_pass http://oam_backend;
}