CVE-2026-60325
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Vulnerability in Oracle Access Manager product of Oracle Fusion Middleware, component Authentication Engine. Affects versions 12.2.1.4.0 and 14.1.2.1.0. An easily exploitable vulnerability allows a low-privileged attacker with access to the physical communication segment to take over Oracle Access Manager.
Risk Assessment
Risk of complete takeover of the access management system, potentially allowing the attacker to bypass authentication and access all protected resources.
Recommendation
Apply the patch provided by Oracle in the Critical Patch Update (CPU) for Fusion Middleware.
Other vulnerabilities in Oracle Fusion Middleware
See all- CVE-2026-60388Critical
Vulnerability in Oracle Fusion Middleware Service Delivery Platform (component: Messaging Enabler). Unauthenticated attacker via network (T3, IIOP) can take over the platform.
- CVE-2026-60387Critical
Vulnerability in Oracle Fusion Middleware Service Delivery Platform (component: Messaging Enabler). Unauthenticated attacker via network (T3, IIOP) can take over the platform.
- CVE-2026-60380Critical
Vulnerability in Oracle Fusion Middleware Service Delivery Platform (component: Messaging Enabler). Unauthenticated attacker via network (HTTP) can take over the platform.
- CVE-2026-60374Critical
Vulnerability in Oracle Fusion Middleware Service Delivery Platform (component: Messaging Enabler). Unauthenticated attacker via network (T3, IIOP) can take over the platform.
- CVE-2026-61099High
Vulnerability in Oracle WebCenter Enterprise Capture product (Oracle Fusion Middleware) in Client Bundle component. Affects versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can take over the system.
- CVE-2026-61098High
Vulnerability in Oracle WebCenter Enterprise Capture product (Oracle Fusion Middleware) in Client Bundle component. Affects versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can take over the system.
- CVE-2026-60657High
Vulnerability in Oracle WebCenter Content (part of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit, requires low privileges and user interaction, but may affect other products. Allows unauthorized access and modification of critical data.
- CVE-2026-60654High
Vulnerability in Oracle WebCenter Content (part of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can take over the system.
- CVE-2026-60563High
Vulnerability in Oracle WebCenter Portal (part of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can take over the portal.
- CVE-2026-60553High
Vulnerability in Oracle WebCenter Sites (part of Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit, allows an unauthenticated attacker via HTTP to gain unauthorized access and modification of critical data, with possible impact on other products.
Original NVD description (English source)
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Access Manager executes to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).