CVE-2026-60726: Oracle Access Manager Auth Bypass Flaw

CVE-2026-60726 Overview

CVE-2026-60726 is a high-severity vulnerability in the Authentication Engine component of Oracle Access Manager, part of Oracle Fusion Middleware. The flaw allows a low-privileged attacker with HTTP network access to compromise the identity and access management (IAM) service. Successful exploitation results in full takeover of Oracle Access Manager, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in its August 2026 Critical Patch Update. The weakness is categorized under CWE-284: Improper Access Control.

Critical Impact
Successful exploitation allows an authenticated attacker to take over Oracle Access Manager, an enterprise single sign-on (SSO) and authentication broker, undermining downstream application authentication.

Affected Products

Oracle Access Manager 12.2.1.4.0
Oracle Access Manager 14.1.2.1.0
Oracle Fusion Middleware deployments using the Authentication Engine component

Discovery Timeline

2026-08-18 - CVE-2026-60726 published to the National Vulnerability Database
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60726

Vulnerability Analysis

Oracle Access Manager (OAM) provides web-based single sign-on, session management, and authentication policy enforcement across Oracle Fusion Middleware and integrated applications. The Authentication Engine component processes login requests, validates credentials, and issues session artifacts consumed by protected resources.

The vulnerability enables an attacker holding low-privilege network credentials to escalate control over OAM through HTTP-based requests. Because OAM brokers authentication for downstream applications, a full takeover extends beyond the OAM host itself. An attacker can forge sessions, impersonate users, or bypass authentication policies applied to protected Fusion Middleware resources. The EPSS score at publication is 0.389%.

Root Cause

Oracle categorizes the weakness under CWE-284: Improper Access Control. The Authentication Engine fails to properly enforce access restrictions on privileged operations, allowing a low-privileged HTTP session to reach functionality that should require higher authorization. Oracle's advisory does not disclose the specific handler or code path involved.

Attack Vector

Exploitation occurs over the network via HTTP against an exposed Oracle Access Manager endpoint. The attacker must hold low-level authenticated access but does not require user interaction. Attack complexity is low and the scope remains unchanged, meaning the impact stays within the OAM security authority. See the Oracle Security Alert for vendor-specific technical detail.

No verified public proof-of-concept code is available for CVE-2026-60726 at the time of writing.
Refer to the Oracle Critical Patch Update advisory for authoritative technical details.

Detection Methods for CVE-2026-60726

Indicators of Compromise

Unexpected administrative or policy-modification actions in Oracle Access Manager audit logs originating from low-privilege accounts.
Anomalous session tokens or OAM_ID cookies issued outside normal authentication flows.
HTTP requests to Authentication Engine endpoints containing unusual parameters or elevated response codes from non-admin sources.

Detection Strategies

Enable and centrally forward Oracle Access Manager audit logs, including WebGate and OAM Server events, to a SIEM for correlation.
Baseline normal request patterns to /oam/server/ endpoints and alert on deviations from expected clients or user roles.
Correlate authentication successes at OAM with downstream application access to detect impersonation or forged sessions.

Monitoring Recommendations

Monitor for privilege changes, policy edits, and administrative API calls in OAM outside change-management windows.
Track outbound connections from OAM hosts to identify post-compromise command-and-control activity.
Alert on repeated failed authentications followed by successful low-privilege logins that subsequently access administrative paths.

How to Mitigate CVE-2026-60726

Immediate Actions Required

Apply the Oracle August 2026 Critical Patch Update fixes for Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 as documented in the Oracle Security Alert.
Restrict network exposure of OAM administrative and Authentication Engine endpoints to trusted management networks.
Rotate credentials and session-signing keys if compromise is suspected after patching.

Patch Information

Oracle addressed CVE-2026-60726 in the August 2026 Critical Patch Update. Administrators should review the Oracle Security Alert for the exact patch bundle applicable to their Fusion Middleware version, apply it in a test environment, and then roll it out across production OAM tiers.

Workarounds

Place a web application firewall (WAF) in front of OAM to enforce strict allowlists on Authentication Engine URIs until patching completes.
Reduce the number of accounts with any authenticated access to OAM administrative interfaces to shrink the pool of potential attackers.
Enable mutual TLS or IP allowlisting on management endpoints to block untrusted low-privilege network access.

bash

# Example: restrict access to OAM admin endpoints at the reverse proxy (nginx)
location /oam/admin/ {
    allow 10.10.0.0/24;   # trusted management subnet
    deny  all;
    proxy_pass https://oam-backend;
}