CVE-2026-60559: 
Oracle Access Manager vulnerability analysis and mitigation

CVE-2026-60559 is an authentication bypass vulnerability in the Authentication Engine component of Oracle Access Manager, part of Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.1.0. The vulnerability allows an unauthenticated remote attacker to gain unauthorized access to critical data via HTTP, with a scope change indicating potential impact on additional products beyond Oracle Access Manager itself. It was published on July 21, 2026, and addressed in Oracle's July 2026 Critical Patch Update. It carries a CVSS v3.1 base score of 8.6 (High) (Oracle CPU Jul2026).

The vulnerability is classified under CWE-284 (Improper Access Control), specifically an authentication bypass in Oracle Access Manager's Authentication Engine component. An unauthenticated attacker with network access via HTTP can exploit this flaw without requiring any user interaction or special privileges, making it easily exploitable. The changed scope indicates that a successful attack can affect resources beyond the vulnerable component itself — potentially impacting all applications and services protected by Oracle Access Manager. No public technical write-ups or proof-of-concept code have been identified at this time (Oracle CPU Jul2026).

Successful exploitation allows an unauthenticated attacker to gain complete unauthorized read access to all data accessible through Oracle Access Manager, including sensitive information managed by the system and all resources it protects. Because Oracle Access Manager functions as a centralized authentication and authorization gateway, a breach can expose credentials, session tokens, and protected application data across the entire enterprise environment. The confidentiality impact is rated High with a changed scope, meaning downstream applications relying on Oracle Access Manager for access control are also at risk. Integrity and availability are not directly impacted by this vulnerability (Oracle CPU Jul2026).

As of the time of publication, there is no evidence of a public proof-of-concept exploit or active in-the-wild exploitation of CVE-2026-60559. The EPSS score is approximately 0.398%, indicating a currently low probability of exploitation in the near term. The vulnerability is marked as "automatable" (no user interaction required) with network-level access, which lowers the barrier for potential future exploitation. It has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog as of this report (Oracle CPU Jul2026).

Oracle has released patches for CVE-2026-60559 as part of the July 2026 Critical Patch Update (CPUJul2026), addressing both affected versions: 12.2.1.4.0 and 14.1.2.1.0. Oracle strongly recommends applying the patch immediately, as the vulnerability is easily exploitable without authentication. As a temporary measure prior to patching, organizations should restrict network access to Oracle Access Manager instances to only authorized IP ranges, implement Web Application Firewall (WAF) rules to detect anomalous authentication requests, and monitor authentication logs for suspicious or unexpected access patterns. Oracle does not recommend relying on network-level blocking as a long-term solution (Oracle CPU Jul2026).