CVE-2026-60416
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Vulnerability in Oracle Access Manager (component: Authentication Engine) versions 12.2.1.4.0 and 14.1.2.1.0. A difficult-to-exploit flaw allows an unauthenticated attacker with network access via HTTP to take over the system.
Risk Assessment
A successful attack can lead to full compromise of Oracle Access Manager, risking confidentiality, integrity, and availability of data.
Recommendation
Apply the patch provided by Oracle for versions 12.2.1.4.0 and 14.1.2.1.0. Restrict server access to trusted networks only.
Other vulnerabilities in Oracle Access Manager
See all- CVE-2015-2593High
Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.2.2 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Configuration Service.
- CVE-2015-0461High
Unspecified vulnerability in the Oracle Access Manager component in Oracle Fusion Middleware 11.1.1.5 and 11.1.1.7 allows remote authenticated users to affect confidentiality and integrity via unknown vectors related to Authentication Engine.
- CVE-2026-70905Critical
Vulnerability in Oracle Access Manager (component: Agent infrastructure) allows an unauthenticated attacker with network access via SAML to compromise the system. The attack is easily exploitable and requires no user interaction.
- CVE-2026-61065Critical
In Oracle Access Manager (component: Authentication Engine), a vulnerability can be exploited by an unauthenticated attacker over the network via HTTP. Successful attack can lead to complete takeover of Oracle Access Manager.
- CVE-2026-60358Critical
Critical vulnerability in Oracle Access Manager (Authentication Engine component) allows an unauthenticated attacker to remotely take over the server via network using HTTP. The attack may impact additional products (scope change).
- CVE-2026-60355Critical
Critical vulnerability in Oracle Access Manager (Authentication Engine component) allows an unauthenticated attacker to remotely take over the server via network using HTTP. The attack does not impact other products (no scope change).
- CVE-2026-60333Critical
Vulnerability in Oracle Access Manager (Authentication Engine component) allows a low-privileged attacker to remotely take over the system via HTTP. The attack may impact additional products (scope change).
- CVE-2026-60328Critical
Vulnerability in Oracle Access Manager (Authentication Engine component) allows an unauthenticated attacker with network access via HTTP to take over the system.
- CVE-2026-60326Critical
Vulnerability in Oracle Access Manager (component: Authentication Engine) allows unauthenticated attacker via HTTP to gain unauthorized access to critical data and modify it. CVSS 9.1.
- CVE-2026-71124Medium
Vulnerability in Oracle Access Manager (Authorization Engine) affects versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker can cause a partial denial of service via network (TCP).
Original NVD description (English source)
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).