CVE-2026-60559: Oracle Access Manager Auth Bypass Flaw

CVE-2026-60559 Overview

CVE-2026-60559 is a high-severity vulnerability in the Authentication Engine component of Oracle Access Manager, part of Oracle Fusion Middleware. An unauthenticated attacker with network access via HTTP can compromise Oracle Access Manager without user interaction. Although the flaw resides in Oracle Access Manager, successful exploitation produces a scope change that can significantly impact additional Oracle products. The vulnerability affects supported versions 12.2.1.4.0 and 14.1.2.1.0. Oracle addressed the issue in the July 2026 Critical Patch Update.

Critical Impact
Remote unauthenticated attackers can gain unauthorized access to critical data or complete access to all data accessible via Oracle Access Manager, with impact extending beyond the vulnerable component due to scope change.

Affected Products

Oracle Access Manager 12.2.1.4.0
Oracle Access Manager 14.1.2.1.0
Oracle Fusion Middleware deployments relying on the Authentication Engine

Discovery Timeline

2026-07-21 - CVE CVE-2026-60559 published to the National Vulnerability Database (NVD)
2026-07-21 - Oracle disclosed the issue in the Oracle Critical Patch Update Advisory for July 2026
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60559

Vulnerability Analysis

The vulnerability resides in the Authentication Engine of Oracle Access Manager, the module responsible for validating credentials and issuing authentication tokens for downstream Fusion Middleware services. An unauthenticated attacker can reach the affected functionality over HTTP and trigger the flaw without any prior access or user interaction. Oracle classifies exploitation as easily achievable.

Successful exploitation results in confidentiality impact only, with no direct impact on integrity or availability. However, because Oracle Access Manager brokers authentication for multiple products, the scope changes, and attackers can access data belonging to systems that trust Oracle Access Manager for identity assertions. This makes the vulnerability a high-value target for adversaries seeking pivots into single sign-on protected applications.

Root Cause

Oracle has not published a detailed root cause analysis. Based on the advisory, the defect is located within the Authentication Engine and is reachable through the HTTP interface exposed by Oracle Access Manager. The scope change classification indicates that trust boundaries between Oracle Access Manager and dependent applications can be crossed during exploitation. Refer to the Oracle Security Alert July 2026 for vendor-supplied details.

Attack Vector

The attack vector is network-based over HTTP. An attacker sends crafted requests to the Oracle Access Manager endpoint exposing the Authentication Engine. No credentials, tokens, or user interaction are required. Because the vulnerable service is typically internet-facing or reachable from broad internal segments to support single sign-on, the exposed attack surface is significant in most enterprise deployments. Technical exploitation details have not been published, and no public proof-of-concept exploit is currently available.

Detection Methods for CVE-2026-60559

Indicators of Compromise

Unexpected HTTP requests to Oracle Access Manager Authentication Engine endpoints from unusual source addresses or user agents.
Anomalous access patterns to applications that trust Oracle Access Manager for single sign-on, particularly requests bypassing normal authentication flows.
Sudden spikes in authentication requests or token issuance events without corresponding user logins.

Detection Strategies

Inspect Oracle Access Manager access logs and audit records for repeated or malformed requests to authentication endpoints.
Correlate authentication activity with downstream application access to identify sessions established without valid credential events.
Deploy web application firewall rules that flag anomalous HTTP payloads targeting Oracle Access Manager URIs.

Monitoring Recommendations

Enable verbose audit logging on the Authentication Engine and forward logs to a centralized SIEM for retention and analysis.
Alert on authentication failures followed by successful token issuance from the same source within short intervals.
Monitor egress from Oracle Access Manager hosts for unusual data flows that could indicate credential or token exfiltration.

How to Mitigate CVE-2026-60559

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 without delay.
Restrict network exposure of Oracle Access Manager Authentication Engine endpoints to trusted networks and reverse proxies until patching is complete.
Review recent authentication logs for evidence of exploitation attempts against the affected endpoints.
Rotate credentials, session keys, and any signing material used by Oracle Access Manager after patching if compromise is suspected.

Patch Information

Oracle released fixes for CVE-2026-60559 in the July 2026 Critical Patch Update. Administrators should apply the patches referenced in the Oracle Security Alert July 2026 for supported Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0. Follow Oracle's documented patching procedure, including pre-patch backups and post-patch verification.

Workarounds

Place Oracle Access Manager behind a hardened reverse proxy or web application firewall that filters malformed HTTP requests to Authentication Engine URIs.
Limit inbound HTTP access to Oracle Access Manager using network segmentation and allowlists until patches are deployed.
Increase logging fidelity on Oracle Access Manager and dependent applications to accelerate identification of exploitation attempts.

bash

# Example: restrict inbound HTTP access to Oracle Access Manager to trusted proxies
# (adapt CIDR ranges and interface names to your environment)
iptables -A INPUT -p tcp --dport 14100 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 14100 -j DROP