CVE-2026-60358 affects Oracle Access Manager, a technology used by organizations to control access to applications and services. Because Access Manager often sits in front of business-critical systems, a compromise could affect far more than the authentication service itself.
The vulnerability is especially relevant to organizations in the United States and Canada that use Oracle Fusion Middleware in banking, healthcare, government, manufacturing, retail, education, or enterprise environments. Internet-facing deployments face the greatest urgency, although internally exposed systems also require prompt attention.
This article explains why CVE-2026-60358 matters to business leaders, how to determine whether your organization may be affected, and what actions to take. A technical appendix provides detection, verification, mitigation, and remediation guidance for security engineers, penetration testers, and information technology professionals.
Oracle disclosed CVE-2026-60358 on July 21, 2026, as part of its July 2026 Critical Patch Update. The affected product is Oracle Access Manager, specifically its Authentication Engine, within Oracle Fusion Middleware. Supported affected versions are 12.2.1.4.0 and 14.1.2.1.0.
The vulnerability has a Common Vulnerability Scoring System version 3.1 score of 10.0, the highest possible rating, and is classified as critical. In plain language, an attacker can reach the vulnerable service over a network without logging in or requiring a victim to click anything. Successful exploitation can result in takeover of Oracle Access Manager and may affect other connected products.
Oracle is listed as the vulnerability source. The July advisory does not publicly credit an external reporter for CVE-2026-60358. Oracle released the associated security update through its July Critical Patch Update program and recommends applying security patches without delay.
You should treat CVE-2026-60358 as an identity and access risk, not merely as an application maintenance issue. Oracle Access Manager can help determine who is allowed to reach internal applications, portals, databases, and administrative services. If that control point is taken over, an attacker may be able to interfere with authentication decisions or use the system as a bridge to other business resources.
The operational impact could include employee or customer login failures, interruption of essential applications, emergency system recovery, and delays to revenue-generating work. In a healthcare organization, access disruption could affect clinical and administrative workflows. In a financial institution, it could interfere with employee systems, customer services, or transaction-supporting applications.
The data risk is equally significant. A compromised access manager may expose information about users, applications, sessions, or connected systems. Depending on the environment, attackers could pursue confidential records, intellectual property, financial information, or personal data.
You may also face contractual, regulatory, and reporting obligations. U.S. organizations could need to evaluate requirements involving state privacy laws, sector regulations, securities disclosures, or federal contracting. Canadian organizations may need to consider privacy obligations under federal or provincial law. The correct response depends on the systems and data involved, so legal and compliance teams should be included in incident evaluation.
Regional Bank: An internet-accessible Access Manager instance is compromised outside business hours. The attacker disrupts employee authentication, forcing the bank to suspend selected internal services while investigators determine whether privileged accounts or connected applications were accessed.
Healthcare Provider: A hospital group relies on Oracle Access Manager for several administrative and patient-supporting applications. A takeover causes authentication instability and creates a potential exposure involving workforce identities and sensitive health information, requiring technical investigation and regulatory review.
Mid-Sized Manufacturer: A manufacturer uses Fusion Middleware to protect supply chain, enterprise resource planning, and partner-facing applications. An attacker compromises the access layer and attempts to move toward systems containing production schedules, supplier records, and proprietary engineering data.
Large Public-Sector Organization: A government department operates several Oracle environments across data centers and cloud-connected networks. Although the vulnerable service is not directly exposed to the public internet, a compromised internal workstation or adjacent system could provide network access, making segmentation and patch verification essential.
CVE-2026-60358 deserves a structured response that combines patch verification, exposure analysis, configuration review, and targeted security testing. IntegSec can help you identify attack paths, validate remediation, and reduce the broader cybersecurity risks surrounding identity infrastructure. Contact IntegSec to schedule a penetration test and strengthen your security program with practical, evidence-based findings.
CVE-2026-60358 is an improper access-control vulnerability in the Authentication Engine component of Oracle Access Manager. The public record does not disclose the vulnerable function or detailed root-cause mechanics. The practical security condition is clear: a remote, unauthenticated attacker can send network requests over HTTP to compromise the affected product.
The attack vector is network-based, attack complexity is low, no privileges are required, and no user interaction is required. The vulnerability has changed scope, meaning exploitation of Oracle Access Manager may affect security-relevant resources beyond the originally vulnerable component. Confidentiality, integrity, and availability impacts are all rated high. The complete CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
NVD identifies the weakness as CWE-284, Improper Access Control. NVD had not provided an independent assessment when retrieved, and its record references Oracle’s July 2026 advisory.
find /opt/oracle -maxdepth 5 -type f -iname '*version*' and review Oracle inventory data with the environment’s supported opatch lsinventory procedure. Paths vary by installation.Oracle warns that network or privilege restrictions are only interim measures and may disrupt functionality. The vendor recommends testing changes outside production and applying the security patches as soon as possible.