CVE-2026-60358: Oracle Access Manager Authentication Bypass Bug - What It Means for Your Business and How to Respond

Introduction

CVE-2026-60358 affects Oracle Access Manager, a technology used by organizations to control access to applications and services. Because Access Manager often sits in front of business-critical systems, a compromise could affect far more than the authentication service itself.

The vulnerability is especially relevant to organizations in the United States and Canada that use Oracle Fusion Middleware in banking, healthcare, government, manufacturing, retail, education, or enterprise environments. Internet-facing deployments face the greatest urgency, although internally exposed systems also require prompt attention.

This article explains why CVE-2026-60358 matters to business leaders, how to determine whether your organization may be affected, and what actions to take. A technical appendix provides detection, verification, mitigation, and remediation guidance for security engineers, penetration testers, and information technology professionals.

S1: Background & History

Oracle disclosed CVE-2026-60358 on July 21, 2026, as part of its July 2026 Critical Patch Update. The affected product is Oracle Access Manager, specifically its Authentication Engine, within Oracle Fusion Middleware. Supported affected versions are 12.2.1.4.0 and 14.1.2.1.0.

The vulnerability has a Common Vulnerability Scoring System version 3.1 score of 10.0, the highest possible rating, and is classified as critical. In plain language, an attacker can reach the vulnerable service over a network without logging in or requiring a victim to click anything. Successful exploitation can result in takeover of Oracle Access Manager and may affect other connected products.

Oracle is listed as the vulnerability source. The July advisory does not publicly credit an external reporter for CVE-2026-60358. Oracle released the associated security update through its July Critical Patch Update program and recommends applying security patches without delay.

S2: What This Means for Your Business

You should treat CVE-2026-60358 as an identity and access risk, not merely as an application maintenance issue. Oracle Access Manager can help determine who is allowed to reach internal applications, portals, databases, and administrative services. If that control point is taken over, an attacker may be able to interfere with authentication decisions or use the system as a bridge to other business resources.

The operational impact could include employee or customer login failures, interruption of essential applications, emergency system recovery, and delays to revenue-generating work. In a healthcare organization, access disruption could affect clinical and administrative workflows. In a financial institution, it could interfere with employee systems, customer services, or transaction-supporting applications.

The data risk is equally significant. A compromised access manager may expose information about users, applications, sessions, or connected systems. Depending on the environment, attackers could pursue confidential records, intellectual property, financial information, or personal data.

You may also face contractual, regulatory, and reporting obligations. U.S. organizations could need to evaluate requirements involving state privacy laws, sector regulations, securities disclosures, or federal contracting. Canadian organizations may need to consider privacy obligations under federal or provincial law. The correct response depends on the systems and data involved, so legal and compliance teams should be included in incident evaluation.

S3: Real-World Examples

Regional Bank: An internet-accessible Access Manager instance is compromised outside business hours. The attacker disrupts employee authentication, forcing the bank to suspend selected internal services while investigators determine whether privileged accounts or connected applications were accessed.

Healthcare Provider: A hospital group relies on Oracle Access Manager for several administrative and patient-supporting applications. A takeover causes authentication instability and creates a potential exposure involving workforce identities and sensitive health information, requiring technical investigation and regulatory review.

Mid-Sized Manufacturer: A manufacturer uses Fusion Middleware to protect supply chain, enterprise resource planning, and partner-facing applications. An attacker compromises the access layer and attempts to move toward systems containing production schedules, supplier records, and proprietary engineering data.

Large Public-Sector Organization: A government department operates several Oracle environments across data centers and cloud-connected networks. Although the vulnerable service is not directly exposed to the public internet, a compromised internal workstation or adjacent system could provide network access, making segmentation and patch verification essential.

S4: Am I Affected?

• You are potentially affected if your organization runs Oracle Access Manager version 12.2.1.4.0 or 14.1.2.1.0.
• You should assume elevated risk if the Authentication Engine is reachable through HTTP or HTTPS from the internet, a partner network, or a broad internal network.
• You should investigate whether Oracle Access Manager supports single sign-on for business-critical applications, databases, portals, or administrative services.
• You should confirm whether the July 2026 Oracle Critical Patch Update has been applied to every affected installation, including standby, disaster recovery, and test environments.
• You should review asset inventories, Oracle middleware records, configuration-management data, and vendor support records if ownership of the system is unclear.
• You should escalate immediately if you find unexpected administrative changes, authentication anomalies, new accounts, unexplained service restarts, or unusual traffic to the Authentication Engine.
• You should not rely solely on an external vulnerability scan. An internally exposed or segmented deployment may still be vulnerable.

Key Takeaways

• CVE-2026-60358 is a critical Oracle Access Manager vulnerability with a CVSS 3.1 score of 10.0.
• An unauthenticated attacker may reach the affected service over a network without user interaction.
• A successful compromise could take over the access-management layer and affect connected applications.
• You should identify affected versions, apply Oracle’s July 2026 security update, and verify the result across production and recovery environments.
• You should investigate authentication logs and connected systems if the vulnerable service was exposed or shows signs of unauthorized activity.

Call to Action

CVE-2026-60358 deserves a structured response that combines patch verification, exposure analysis, configuration review, and targeted security testing. IntegSec can help you identify attack paths, validate remediation, and reduce the broader cybersecurity risks surrounding identity infrastructure. Contact IntegSec to schedule a penetration test and strengthen your security program with practical, evidence-based findings.

Technical Appendix

A: Technical Analysis

CVE-2026-60358 is an improper access-control vulnerability in the Authentication Engine component of Oracle Access Manager. The public record does not disclose the vulnerable function or detailed root-cause mechanics. The practical security condition is clear: a remote, unauthenticated attacker can send network requests over HTTP to compromise the affected product.

The attack vector is network-based, attack complexity is low, no privileges are required, and no user interaction is required. The vulnerability has changed scope, meaning exploitation of Oracle Access Manager may affect security-relevant resources beyond the originally vulnerable component. Confidentiality, integrity, and availability impacts are all rated high. The complete CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

NVD identifies the weakness as CWE-284, Improper Access Control. NVD had not provided an independent assessment when retrieved, and its record references Oracle’s July 2026 advisory.

B: Detection & Verification

• Enumerate installed middleware versions through approved Oracle administration procedures, configuration-management records, or package inventories. Confirm both the Oracle Access Manager release and the applied patch level.
• On Linux systems, authorized administrators can use commands such as find /opt/oracle -maxdepth 5 -type f -iname '*version*' and review Oracle inventory data with the environment’s supported opatch lsinventory procedure. Paths vary by installation.
• On Windows systems, review the Oracle Universal Installer inventory, service definitions, installation directories, and approved software-asset records. Avoid treating directory names alone as proof of a patched state.
• Configure vulnerability scanners to identify Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 and verify the July 2026 Oracle patch level. Scanner results should be authenticated where possible.
• Review web-server and Access Manager logs for unauthenticated requests, authentication-engine errors, unexpected administrative actions, unusual response patterns, repeated requests from unfamiliar addresses, and service restarts.
• Correlate identity-provider logs, reverse-proxy records, firewall telemetry, and endpoint alerts for suspicious traffic involving the Access Manager hosts.
• Do not conduct exploit testing against production without written authorization, a defined scope, and an approved change window.

C: Mitigation & Remediation

1. Immediate, 0 to 24 hours: Identify every Oracle Access Manager deployment and determine whether affected versions are present. Restrict access to trusted networks through firewalls, reverse proxies, or access-control lists. Remove unnecessary internet exposure and preserve relevant logs before making major configuration changes.
2. Short-term, 1 to 7 days: Apply the official Oracle July 2026 Critical Patch Update for the affected Oracle Access Manager release through Oracle’s supported distribution and installation process. Oracle lists Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 among the affected products and directs customers to its patch-availability documentation. Validate the patch in a nonproduction environment, then deploy it to production, standby, disaster recovery, and overlooked administrative instances.
3. If patching is delayed: Keep the service behind a tightly controlled network boundary, permit only required source systems, restrict administrative access, and consider temporarily disabling nonessential externally reachable authentication paths. Use layered monitoring and enhanced alerting. These measures reduce exposure but do not fix the vulnerability.
4. Long-term, ongoing: Confirm remediation with authenticated scanning, Oracle inventory review, configuration inspection, and an authorized penetration test. Review trust relationships and applications that rely on Access Manager. Rotate potentially exposed credentials or tokens when evidence indicates compromise, and conduct incident response before declaring the environment clean.

Oracle warns that network or privilege restrictions are only interim measures and may disrupt functionality. The vendor recommends testing changes outside production and applying the security patches as soon as possible.

D: Best Practices

• Keep internet-facing identity and access services on actively supported Oracle releases with a documented patch-service-level target.
• Enforce strong network segmentation so an access-management compromise cannot provide unrestricted reach into sensitive application tiers.
• Minimize exposed protocols, listener paths, administrative interfaces, and trusted source networks.
• Monitor authentication-engine logs alongside reverse-proxy, firewall, identity, and endpoint telemetry.
• Test recovery procedures, token and credential rotation, and application failover before an access-management incident occurs.