CVE-2026-60355: Oracle Access Manager Auth Bypass Flaw

CVE-2026-60355 Overview

CVE-2026-60355 is a critical vulnerability in the Authentication Engine component of Oracle Access Manager, part of Oracle Fusion Middleware. An unauthenticated attacker with network access via HTTP can compromise Oracle Access Manager without user interaction. Successful exploitation results in complete takeover of the Oracle Access Manager instance, impacting confidentiality, integrity, and availability. Oracle disclosed this issue in the July 2026 Critical Patch Update. The vulnerability affects Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0.

Critical Impact
Unauthenticated remote attackers can take over Oracle Access Manager over HTTP, undermining the central authentication broker for downstream Fusion Middleware and enterprise applications.

Affected Products

Oracle Access Manager 12.2.1.4.0
Oracle Access Manager 14.1.2.1.0
Oracle Fusion Middleware deployments using the Authentication Engine component

Discovery Timeline

2026-07-21 - CVE-2026-60355 published to NVD
2026-07-21 - Last updated in NVD database
Vendor advisory published in the Oracle Critical Patch Update - July 2026

Technical Details for CVE-2026-60355

Vulnerability Analysis

The flaw resides in the Authentication Engine component of Oracle Access Manager (OAM), the module responsible for validating credentials and issuing session tokens. The vulnerability is remotely exploitable over HTTP without authentication and without user interaction. A successful attack yields full takeover of the OAM instance, meaning attackers can forge sessions, impersonate users, and pivot into any application that federates authentication through OAM.

Because OAM commonly fronts enterprise portals, WebLogic domains, and Oracle E-Business Suite, a compromise cascades across the identity trust boundary. Oracle categorizes the issue as easily exploitable, indicating no complex preconditions are required.

Root Cause

Oracle has not published low-level technical detail beyond the Critical Patch Update advisory. The impact profile — unauthenticated network takeover of an authentication broker — is consistent with a flaw in how the Authentication Engine parses or trusts attacker-controlled HTTP input during the credential handling flow. Refer to the Oracle Critical Patch Update advisory for authoritative technical guidance.

Attack Vector

The attack path is network-based over HTTP against exposed Oracle Access Manager endpoints. The attacker requires no privileges and no user interaction. Any OAM instance reachable from an attacker-controlled network position — including internet-exposed deployments and adversaries with internal footholds — is in scope. The vulnerability mechanism is described in prose because no verified public exploit code exists at time of writing.

Detection Methods for CVE-2026-60355

Indicators of Compromise

Anomalous HTTP requests to OAM authentication endpoints such as /oam/server/, /oamsso/, and /oam/services/rest/ from unexpected source addresses.
Unexpected creation of OAM session tokens or OAM_ID cookies without a corresponding valid login event in the audit log.
New administrative or privileged sessions in downstream applications that federate through OAM but lack matching authentication events.

Detection Strategies

Correlate OAM access logs with backend application logs to surface sessions that bypass normal credential validation.
Alert on unauthenticated HTTP requests that trigger authentication engine code paths returning success responses.
Baseline request volume and geography against OAM login URIs and flag statistical anomalies.

Monitoring Recommendations

Forward OAM audit logs, WebLogic access logs, and reverse proxy logs to a centralized analytics platform for correlation.
Monitor for outbound connections from OAM hosts to unexpected destinations, indicating post-exploitation command and control.
Track file integrity on OAM configuration directories and the DOMAIN_HOME to detect tampering after takeover.

How to Mitigate CVE-2026-60355

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update fixes for Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 without delay.
Restrict network reachability to OAM administrative and authentication endpoints to trusted networks and reverse proxies only.
Rotate OAM signing keys, OAuth client secrets, and administrative credentials after patching to invalidate any tokens minted during a potential compromise window.

Patch Information

Oracle released fixes as part of the July 2026 Critical Patch Update. Administrators should review the Oracle Critical Patch Update - July 2026 advisory for the specific patch identifiers applicable to each supported version and apply them through Oracle's standard OPatch process.

Workarounds

Place OAM behind a web application firewall configured to block anomalous requests to authentication endpoints until patching completes.
Disable or firewall external access to OAM management URIs where business requirements permit.
Enforce mutual TLS or IP allowlisting on OAM administrative interfaces to reduce the exposed attack surface.

bash

# Example: restrict access to OAM endpoints at the reverse proxy (nginx)
location /oam/ {
    allow 10.0.0.0/8;
    deny  all;
    proxy_pass https://oam-backend;
}