CVE-2026-60325: High severity Oracle Oracle Access Manager (Authentication Engine) vulnerability
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Access Manager executes to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Oracle Fusion Middleware - Oracle Access Manager (Authentication Engine)to a version that resolves this vulnerability.Fixed in 12.2.1.4.0 - Upgrade
Upgrade
Oracle Fusion Middleware - Oracle Access Manager (Authentication Engine)to a version that resolves this vulnerability.Fixed in 14.1.2.1.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-60325?
CVE-2026-60325 has a severity rating of high, with a CVSS score of 8.
What products are affected by CVE-2026-60325?
CVE-2026-60325 affects Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0.
What type of vulnerability is identified in CVE-2026-60325?
CVE-2026-60325 is an easily exploitable vulnerability in the Authentication Engine component of Oracle Access Manager.
How can I mitigate the risks of CVE-2026-60325?
Mitigating the risks of CVE-2026-60325 involves applying the latest security patches provided by Oracle for affected versions.
Who can exploit CVE-2026-60325?
CVE-2026-60325 can be exploited by a low privileged attacker with access to the physical communication segment.