CVE-2026-61065: Oracle Access Manager Auth Bypass Flaw

CVE-2026-61065 Overview

CVE-2026-61065 is a critical vulnerability in the Authentication Engine component of Oracle Access Manager, part of Oracle Fusion Middleware. The flaw allows an unauthenticated remote attacker with network access via HTTP to compromise Oracle Access Manager. Successful exploitation results in complete takeover of the identity and access management service, affecting confidentiality, integrity, and availability. Oracle disclosed the issue in the Critical Patch Update advisory published in July 2026.

Critical Impact
Unauthenticated attackers can take over Oracle Access Manager over the network, gaining control of the single sign-on and authentication gateway protecting downstream enterprise applications.

Affected Products

Oracle Access Manager version 12.2.1.4.0
Oracle Access Manager version 14.1.2.1.0
Oracle Fusion Middleware deployments exposing the Authentication Engine over HTTP

Discovery Timeline

2026-07-21 - CVE CVE-2026-61065 published to NVD
2026-07-21 - Last updated in NVD database
July 2026 - Oracle published the Oracle Security Alert July 2026 containing the fix

Technical Details for CVE-2026-61065

Vulnerability Analysis

Oracle Access Manager (OAM) is the single sign-on and federation service for Oracle Fusion Middleware. The Authentication Engine handles credential collection, session establishment, and policy enforcement for downstream applications. A flaw in this component permits an attacker to compromise the service without prior authentication, using only HTTP network reachability.

Oracle classifies the issue as easily exploitable and assigns the highest confidentiality, integrity, and availability impacts. A successful attack results in full takeover of OAM, which typically brokers identity for portals, APIs, and enterprise workloads. Compromise of OAM cascades into unauthorized access to every relying application. The EPSS score at publication is 0.486%.

Root Cause

Oracle has not published detailed root-cause information. The advisory lists the Authentication Engine as the affected subcomponent and indicates that the flaw is reachable over HTTP without credentials or user interaction. This pattern is consistent with input handling or authentication bypass defects in Java-based OAM request processing endpoints. Refer to the Oracle Security Alert July 2026 for vendor guidance.

Attack Vector

The attack vector is network-based. An unauthenticated adversary sends crafted HTTP requests to an exposed Oracle Access Manager endpoint. No user interaction is required and attack complexity is low. Because OAM commonly sits at the perimeter or DMZ to serve federated authentication, internet-exposed instances are directly reachable by remote attackers.

Exploitation code is not publicly available at the time of writing.
Refer to the Oracle Critical Patch Update advisory for technical details.

Detection Methods for CVE-2026-61065

Indicators of Compromise

Unexpected administrative or configuration changes within the OAM console or oam-config.xml
New or modified authentication schemes, policies, or identity store bindings created without change-management approval
Anomalous outbound connections from the WebLogic managed servers hosting OAM
Unusual HTTP requests to /oam/server/, /oamfed/, or authentication endpoints from a small number of source IP addresses

Detection Strategies

Baseline normal HTTP traffic patterns to OAM endpoints and alert on request bursts or malformed parameters targeting the Authentication Engine
Correlate WebLogic access logs with OAM audit logs to identify authentication events that lack a corresponding user session
Monitor for process spawning from WebLogic Java processes on OAM hosts, which is atypical during normal operation
Review privileged group membership and OAM system administrator roles for unauthorized additions

Monitoring Recommendations

Forward OAM audit logs, WebLogic server logs, and reverse proxy logs to a centralized SIEM for correlation
Enable file integrity monitoring on OAM configuration directories and keystore locations
Track outbound network egress from OAM hosts and alert on connections to non-Oracle infrastructure
Alert on service restarts, JVM crashes, and unexpected redeployments of the OAM managed server

How to Mitigate CVE-2026-61065

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 deployments
Inventory internet-exposed OAM endpoints and restrict access to trusted networks until patching is complete
Rotate OAM administrative credentials, keystores, and federation signing keys if compromise is suspected
Review authentication policies and identity store configurations for unauthorized modifications

Patch Information

Oracle addressed CVE-2026-61065 in the July 2026 Critical Patch Update. See the Oracle Security Alert July 2026 for the full patch matrix, affected versions, and installation prerequisites. Apply patches to both 12.2.1.4.0 and 14.1.2.1.0 branches according to Oracle's guidance.

Workarounds

Place OAM behind a web application firewall configured to filter malformed HTTP requests to the Authentication Engine
Restrict inbound HTTP access to OAM endpoints using network ACLs, allowing only known reverse proxies and load balancers
Disable unused authentication schemes and federation endpoints to reduce the exposed attack surface
Increase logging verbosity on OAM and forward audit events to a monitored collection point until patches are applied

bash

# Example: restrict OAM Authentication Engine ports to trusted upstream proxies
iptables -A INPUT -p tcp --dport 14100 -s <trusted_proxy_cidr> -j ACCEPT
iptables -A INPUT -p tcp --dport 14100 -j DROP