CVE-2026-61067: 
Oracle Access Manager vulnerability analysis and mitigation

CVE-2026-61067 is an improper authentication vulnerability in the Authentication Engine component of Oracle Access Manager, part of Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with access to the physical network segment where Oracle Access Manager executes can exploit this vulnerability to achieve full system takeover. It was published on July 21, 2026, and addressed in Oracle's July 2026 Critical Patch Update. The CVSS v3.1 base score is 8.0 (High) (Oracle CPU Jul 2026).

The vulnerability is classified as CWE-287 (Improper Authentication), meaning the Oracle Access Manager Authentication Engine fails to adequately verify the identity of actors under certain conditions. Exploitation requires the attacker to be on the same physical or logical network segment as the Oracle Access Manager host (adjacent network attack vector), with low privileges — no user interaction is required. The low attack complexity suggests the flaw is straightforward to exploit once network adjacency is established. No public technical write-ups or proof-of-concept code have been identified at this time (Oracle CPU Jul 2026).

Successful exploitation results in complete takeover of the Oracle Access Manager system, with high impacts to confidentiality, integrity, and availability. An attacker could read sensitive authentication data and credentials managed by Oracle Access Manager, modify system configuration, and disrupt service availability. Because Oracle Access Manager serves as a centralized identity and access management gateway, its compromise could enable lateral movement to downstream systems and applications that rely on it for authentication and authorization (Oracle CPU Jul 2026).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.287%, indicating a low probability of exploitation in the near term. The NVD SSVC assessment notes exploitation is currently "none" and the attack is not automatable, though the technical impact is rated "total" (Oracle CPU Jul 2026).

Oracle has released patches for both affected versions (12.2.1.4.0 and 14.1.2.1.0) as part of the July 2026 Critical Patch Update. Organizations should apply the relevant patches immediately by following the Fusion Middleware patch availability documentation linked from the Oracle CPU advisory. As a temporary workaround, restrict physical and logical network access to the communication segments connected to Oracle Access Manager infrastructure, and implement network segmentation to prevent untrusted hosts from reaching the OAM network segment. Oracle strongly recommends against relying on network-level mitigations as a long-term solution (Oracle CPU Jul 2026).