CVE-2026-60342: Medium severity Oracle Oracle Access Manager (Oracle Fusion Middleware) - Authentication Engine vulnerability

Published Jul 21, 2026

Updated

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Access Manager accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).

Affected Software

3 affected components

Oracle Oracle Access Manager (Oracle Fusion Middleware) - Authentication Engine=12.2.1.4.0, =14.1.2.1.0

Oracle Access Manager=12.2.1.4.0

Oracle Access Manager=14.1.2.1.0

Event History

Jul 21, 2026

CVE Published

via MITRE·09:34 PM

Data Sourced

via MITRE·09:34 PM

DescriptionSeverity

Data Sourced

via NVD·10:17 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-60342?

CVE-2026-60342 has a medium severity rating of 5.3.

How do I fix CVE-2026-60342?

To mitigate CVE-2026-60342, update Oracle Access Manager to a version that is not affected, specifically versions later than 12.2.1.4.0 and 14.1.2.1.0.

Who can exploit CVE-2026-60342?

CVE-2026-60342 can be exploited by an unauthenticated attacker with network access via HTTP.

What component of Oracle Fusion Middleware is affected by CVE-2026-60342?

CVE-2026-60342 affects the Authentication Engine component of the Oracle Access Manager within Oracle Fusion Middleware.

Which versions of Oracle Access Manager are affected by CVE-2026-60342?

The affected versions of Oracle Access Manager for CVE-2026-60342 are 12.2.1.4.0 and 14.1.2.1.0.