CVE-2026-60358: Critical severity Oracle Oracle Access Manager vulnerability
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-60358?
The severity of CVE-2026-60358 is rated as critical with a score of 10.
How do I fix CVE-2026-60358?
To fix CVE-2026-60358, update Oracle Access Manager to the latest available version.
What components are affected by CVE-2026-60358?
CVE-2026-60358 affects the Authentication Engine component of Oracle Access Manager within Oracle Fusion Middleware.
What are the supported versions affected by CVE-2026-60358?
The supported versions affected by CVE-2026-60358 are 12.2.1.4.0 and 14.1.2.1.0.
Can CVE-2026-60358 be exploited remotely?
Yes, CVE-2026-60358 can be easily exploited by an unauthenticated attacker with network access via HTTP.