VulnSocial

CVE-2026-60358Patch(oracle / access_manager)

LOWCVSS 10.0 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch oracle access_manager systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

oracle CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories
Weakness type (CWE)
CWE-284

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • access_manager

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 2 signals
  • General: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-07-23); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
oracle
Products
access_manager

2 versions affected across 1 product

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-07-23: 1Mentions · 2026-08-28: 1Patch / Workaround · 2026-07-23: 1Technical Details · 2026-07-23: 1Technical Details · 2026-08-28: 107-2308-28
Signal classification2 categories
Patch
150.0%
General
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-07-231
Patch1
2026-08-281
General1
Full discourse2 posts
  • IntegSec@integ_sec
    General

    CVE-2026-60358: Oracle Access Manager Authentication Bypass Bug - What It Means for Your Business and How to Respond https://hubs.li/Q04vJ78r0

    Post summary

    The snippet appears to be a reference to an online article about CVE-2026-60358 that highlights the Oracle Access Manager authentication bypass issue and advises businesses on how to respond, but it does not provide exploit details, patch information, or evidence of active exploitation.

    0000032
    36 followersView on X
  • SecAlerts@SecAlertsCo
    Patch

    🔓 Oracle Access Manager hit with CVSS 10. CVE-2026-60358 targets the Authentication Engine in versions 12.2.1.4.0 and 14.1.2.1.0 — no auth, no user interaction, full C/I/A impact. Patch now. #Oracle #cybersecurity https://secalerts.co/vulnerability/CVE-2026-60358?utm_campaign=x https://t.co/SWFPk6cVrR

    Post summary

    Oracle Access Manager CVE‑2026‑60358 is a high‑score authentication‑engine flaw (CVSS 10, no auth, no user interaction, full CIA impact) that has already been patched—no PoC, exploit, or active exploitation reported.

    00000104
    867 followersView on X
CPE platform detail2 entries

2 of 2 entries

PartVendorProductVersionTarget SWTarget HW
Apporacleaccess_manager12.2.1.4.0--
Apporacleaccess_manager14.1.2.1.0--

Explore more

Back to dashboardoracle CVEsaccess_manager vulnerabilities