CVE-2026-61067: Oracle Access Manager Auth Bypass Flaw

CVE-2026-61067 Overview

CVE-2026-61067 affects the Authentication Engine component of Oracle Access Manager, part of Oracle Fusion Middleware. The flaw allows a low-privileged attacker with access to the adjacent physical network segment to compromise Oracle Access Manager. Successful exploitation results in full takeover of the identity management service, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in the July 2026 Critical Patch Update. Affected versions include Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0. Because Oracle Access Manager frequently mediates single sign-on for downstream applications, compromise creates cascading risk across enterprise authentication flows.

Critical Impact
A low-privileged attacker on the adjacent network can take over Oracle Access Manager, breaking authentication for every application that relies on it.

Affected Products

Oracle Access Manager 12.2.1.4.0
Oracle Access Manager 14.1.2.1.0
Oracle Fusion Middleware deployments using the Authentication Engine component

Discovery Timeline

2026-07-21 - Oracle publishes the July 2026 Critical Patch Update advisory
2026-07-21 - CVE-2026-61067 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-61067

Vulnerability Analysis

The vulnerability resides in the Authentication Engine of Oracle Access Manager (OAM), the module responsible for validating credentials and issuing session artifacts for federated applications. Oracle's advisory characterizes the flaw as easily exploitable and states that successful attacks lead to takeover of Oracle Access Manager. The attacker must hold a low-privileged account and reach the OAM host over the adjacent physical or logical network segment. No user interaction is required, and the attack does not cross a security boundary once inside the segment. Because OAM issues authentication tokens for downstream Fusion Middleware and custom applications, a takeover typically enables lateral movement into those workloads and impersonation of legitimate users.

Root Cause

Oracle has not published the specific class of defect in the public advisory. The Authentication Engine is the affected subcomponent, and the required attack conditions — adjacent network access with low privileges and no user interaction — indicate a flaw in how the engine processes authenticated protocol traffic between trusted OAM nodes or agents. Enterprises should treat Oracle's July 2026 Critical Patch Update as the authoritative technical reference.

Attack Vector

The attack vector is Adjacent Network. An attacker positioned on the same broadcast domain, VLAN, or private subnet as the OAM server, and authenticated with any low-privilege account, can send crafted requests to the Authentication Engine. The resulting compromise yields control of OAM, including its policy store and session issuance functions. Public exploitation has not been reported, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified proof-of-concept code is available. Refer to the Oracle Security Alert July 2026 for vendor-provided technical context.

Detection Methods for CVE-2026-61067

Indicators of Compromise

Unexpected administrative changes in the OAM policy store or identity provider configuration.
New or modified OAM agents, resource protection policies, or authentication schemes not tied to a change ticket.
Anomalous session tokens or SSO assertions issued from OAM to applications outside normal business hours.
Authentication Engine process restarts or crash entries in oam_server*.log without corresponding operations activity.

Detection Strategies

Baseline traffic to the OAM Authentication Engine ports and alert on new source hosts within the adjacent network segment.
Correlate low-privileged OAM logins with subsequent administrative API calls to detect privilege transitions.
Ingest OAM audit and WebLogic access logs into a SIEM and build rules for unauthorized policy or agent modifications.

Monitoring Recommendations

Forward OAM audit logs, WebLogic server logs, and host telemetry to a centralized analytics platform for retention and query.
Monitor east-west traffic between the OAM subnet and application tiers for protocol anomalies and unexpected peers.
Track outbound token issuance rates from OAM and alert on statistical deviations from historical baselines.

How to Mitigate CVE-2026-61067

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 deployments.
Restrict network reachability of OAM management and inter-node ports to a dedicated administrative segment.
Audit low-privileged OAM accounts and disable or rotate credentials for any account that does not require active access.
Review recent OAM policy, agent, and authentication scheme changes for unauthorized modifications.

Patch Information

Oracle addressed CVE-2026-61067 in the July 2026 Critical Patch Update. Administrators should download and apply the patches for Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 as described in the Oracle Security Alert July 2026. Validate patch application by confirming the OAM build version after installation and running Oracle's post-patch verification steps.

Workarounds

Place OAM servers behind strict layer-2 and layer-3 segmentation so only known administrative hosts share the adjacent network.
Enforce mutual TLS and IP allow-listing on OAM inter-node and agent communication where supported.
Require multi-factor authentication for all accounts that can reach OAM administrative interfaces, reducing exposure of low-privileged credentials.

bash

# Configuration example: restrict OAM management port exposure with firewalld
firewall-cmd --permanent --zone=oam-admin --add-source=10.20.30.0/24
firewall-cmd --permanent --zone=oam-admin --add-port=14100/tcp
firewall-cmd --permanent --zone=public --remove-port=14100/tcp
firewall-cmd --reload