CVE-2026-60358: 
Oracle Access Manager vulnerability analysis and mitigation

CVE-2026-60358 is a critical improper access control vulnerability (CWE-284) in the Authentication Engine component of Oracle Access Manager, part of Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.1.0. The vulnerability was published on July 21, 2026, and patched as part of Oracle's July 2026 Critical Patch Update (CPU). It carries a CVSS v3.1 base score of 10.0 (Critical), reflecting its unauthenticated, network-exploitable, scope-changing nature (Oracle CPU Jul 2026, Feedly).

The vulnerability is classified under CWE-284 (Improper Access Control) and resides in the Authentication Engine component of Oracle Access Manager. An unauthenticated remote attacker can exploit this flaw over HTTP with low attack complexity, requiring no privileges and no user interaction. The scope is marked as "Changed," meaning successful exploitation can cascade to impact additional products or systems that rely on Oracle Access Manager for authentication and identity services. No public proof-of-concept or detailed technical write-up has been disclosed as of the time of reporting (Oracle CPU Jul 2026, Feedly).

Successful exploitation results in a complete takeover of Oracle Access Manager, with high impacts to confidentiality, integrity, and availability. An attacker can read sensitive authentication data, modify system configurations, and disrupt service availability. Because Oracle Access Manager serves as a centralized identity and access management gateway, compromise can enable lateral movement into dependent systems and applications that rely on it for authentication, significantly amplifying the blast radius beyond the directly affected product (Oracle CPU Jul 2026, Feedly).

As of the time of reporting, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation. The vulnerability is classified as "automatable" by NVD's SSVC analysis, meaning it can be exploited at scale without manual interaction. The EPSS score is approximately 0.49%, indicating a currently low but non-negligible probability of exploitation in the near term. The vulnerability has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog as of this report (Oracle CPU Jul 2026, Feedly).

Oracle has released patches for both affected versions (12.2.1.4.0 and 14.1.2.1.0) as part of the July 2026 Critical Patch Update. Oracle strongly recommends applying the CPU patches immediately. As a temporary measure while patches are being deployed, administrators should restrict network access to Oracle Access Manager to trusted networks only and monitor for suspicious authentication patterns or unauthorized access attempts. Oracle does not recommend relying on network-level blocking as a long-term solution, as it does not address the underlying vulnerability (Oracle CPU Jul 2026).

The July 2026 Oracle CPU, which includes this vulnerability, was noted by security researchers as a record-breaking release containing 1,449 patches. CVE-2026-60358 was highlighted by multiple threat intelligence outlets as one of the most critical issues in the update due to its perfect CVSS score of 10.0 and unauthenticated remote exploitation potential. CyCognito published a dedicated blog post on the vulnerability, and it was featured in weekly threat intelligence briefings and security news roundups (CyCognito Blog, SOCRadar Blog, SecurityOnline).