CVE-2026-60356: Oracle Access Manager Auth Bypass Flaw

CVE-2026-60356 Overview

CVE-2026-60356 is an authentication bypass vulnerability in the Authentication Engine component of Oracle Access Manager, part of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via HTTP can exploit the vulnerability without user interaction. Successful exploitation grants unauthorized access to critical data or complete access to all Oracle Access Manager accessible data. The vulnerability has a scope change, meaning attacks can significantly impact additional products beyond Oracle Access Manager itself.

Critical Impact
Unauthenticated remote attackers can gain access to sensitive data managed by Oracle Access Manager, with impact extending to downstream applications relying on it for authentication.

Affected Products

Oracle Access Manager 12.2.1.4.0
Oracle Access Manager 14.1.2.1.0
Oracle Fusion Middleware (Authentication Engine component)

Discovery Timeline

2026-07-21 - CVE CVE-2026-60356 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Addressed in Oracle Critical Patch Update advisory

Technical Details for CVE-2026-60356

Vulnerability Analysis

The vulnerability resides in the Authentication Engine of Oracle Access Manager (OAM), a component responsible for validating user identities and enforcing single sign-on across integrated applications. An attacker can send crafted HTTP requests over the network to reach the authentication logic without possessing valid credentials. The exploit path requires no privileges and no user interaction, making it accessible to any actor able to reach the OAM HTTP endpoint.

Because OAM brokers authentication for downstream Fusion Middleware and enterprise applications, successful exploitation carries a scope change. Data belonging to protected applications, not just OAM itself, becomes accessible. The impact is limited to confidentiality: integrity and availability are not affected according to the CVSS vector.

Root Cause

Oracle has not published detailed root-cause analysis. The advisory identifies the Authentication Engine as the vulnerable component and confirms the issue is easily exploitable over HTTP without authentication. This pattern is consistent with an authentication bypass or improper access control weakness in request handling within the engine.

Attack Vector

The attack vector is network-based over HTTP. The attacker sends specifically crafted requests to the OAM Authentication Engine endpoint. No valid session, token, or credential is required prior to exploitation. Because OAM is typically internet-facing to support federated sign-on, exposed instances are directly reachable by remote adversaries.

No public proof-of-concept code is currently available. Refer to the Oracle Security Alert July 2026 for vendor-supplied technical details.

Detection Methods for CVE-2026-60356

Indicators of Compromise

Anomalous HTTP requests to Oracle Access Manager authentication endpoints, particularly with malformed parameters or unexpected header combinations.
Successful authentication events with no corresponding credential validation records in OAM audit logs.
Unexpected access to protected downstream applications from unfamiliar IP ranges or user agents.
Spikes in OAM Authentication Engine traffic outside normal business patterns.

Detection Strategies

Enable verbose logging on the OAM Authentication Engine and forward logs to a centralized analytics platform for correlation.
Establish behavioral baselines for authentication traffic and alert on deviations in request rate, source geography, or endpoint targeting.
Correlate OAM audit trails with downstream application access logs to detect unauthorized session use.
Deploy web application firewall signatures for anomalous request patterns targeting OAM URIs.

Monitoring Recommendations

Continuously monitor OAM server processes for unexpected data exfiltration or outbound connections.
Track privileged data access events in applications protected by OAM for unusual read volumes.
Alert on authentication successes originating from IP addresses not previously observed for the affected user.
Review Oracle CPU advisory feeds regularly to stay current on related Fusion Middleware issues.

How to Mitigate CVE-2026-60356

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 deployments.
Inventory all internet-exposed OAM endpoints and restrict access to trusted networks where feasible.
Rotate credentials and session tokens for any accounts that may have been accessed while systems were unpatched.
Review OAM audit logs for signs of exploitation activity dating back before patch installation.

Patch Information

Oracle addressed CVE-2026-60356 in the July 2026 Critical Patch Update. Administrators should download the applicable patch bundle from My Oracle Support and follow Oracle's staged deployment procedure for Fusion Middleware. Full remediation details are available in the Oracle Security Alert July 2026.

Workarounds

Restrict HTTP access to the OAM Authentication Engine to known application hosts and administrative networks using firewall or reverse proxy rules.
Place a web application firewall in front of OAM to filter anomalous requests targeting authentication endpoints.
Increase audit logging verbosity and forward events to a SIEM for near real-time review until patching is complete.
Disable unused OAM authentication schemes to reduce the exposed attack surface.

bash

# Example: restrict access to OAM authentication endpoints at the reverse proxy
# (Apache HTTP Server example - adapt to your environment)
<Location /oam/server>
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Location>