CVE-2026-61065: 
Oracle Access Manager vulnerability analysis and mitigation

CVE-2026-61065 is a critical improper authentication vulnerability (CWE-287) in the Authentication Engine component of Oracle Access Manager, part of Oracle Fusion Middleware. Affected versions are 12.2.1.4.0 and 14.1.2.1.0. The vulnerability was published on July 21, 2026, and a patch was made available via Oracle's Critical Patch Update (CPU) for July 2026. It carries a CVSS v3.1 base score of 9.8 (Critical), reflecting its unauthenticated, network-exploitable nature with full confidentiality, integrity, and availability impact (Oracle CPU July 2026).

The vulnerability is rooted in improper authentication (CWE-287) within Oracle Access Manager's Authentication Engine, meaning the component fails to adequately verify the identity of actors attempting to interact with it over HTTP. An unauthenticated remote attacker with network access can exploit this flaw without requiring any privileges or user interaction, making it highly automatable. The attack vector is network-based, with low complexity, and no special preconditions beyond HTTP reachability to the affected Oracle Access Manager instance are required. No public proof-of-concept or detailed technical write-up has been identified at this time (Oracle CPU July 2026).

Successful exploitation results in a complete takeover of the Oracle Access Manager system, with high impact to confidentiality, integrity, and availability. Since Oracle Access Manager serves as a centralized identity and access management platform, compromise could allow an attacker to manipulate authentication decisions, impersonate users, access protected resources across integrated applications, and potentially pivot laterally throughout the enterprise environment. The scope of impact extends beyond the Access Manager instance itself to any systems relying on it for authentication and authorization (Oracle CPU July 2026).

As of the time of reporting, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation. The vulnerability is classified as automatable by NVD's SSVC analysis, meaning it can be exploited at scale without manual interaction. The EPSS score is approximately 0.49%, indicating a currently low but non-negligible probability of exploitation in the near term. The vulnerability has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog as of this report (Oracle CPU July 2026).

Oracle has released patches for CVE-2026-61065 as part of the July 2026 Critical Patch Update, addressing versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Access Manager. Organizations should apply the CPU patches immediately by following the guidance in the Oracle Fusion Middleware patch availability documentation. As a temporary workaround prior to patching, Oracle recommends restricting network access to Oracle Access Manager components to trusted networks only and implementing network-level controls to limit HTTP exposure. Oracle strongly cautions that workarounds do not address the underlying vulnerability and should not be treated as long-term solutions (Oracle CPU July 2026).

A post on Bluesky from the cyberhub.blog account referenced the vulnerability shortly after disclosure, indicating early community awareness. No significant vendor statements beyond Oracle's CPU advisory or notable independent researcher commentary have been identified at this time (Oracle CPU July 2026).