This vulnerability affects the Authentication Engine component of Oracle Access Manager in Oracle Fusion Middleware. The flaw permits an attacker with low privileges and physical network segment access to compromise Oracle Access Manager, potentially resulting in complete system takeover. The CVSS 3.1 base score is 8.0, reflecting high impact on confidentiality, integrity, and availability. The affected versions explicitly identified are 12.2.1.4.0 and 14.1.2.1.0. The vulnerability requires physical network segment access, which limits remote exploitation. No official patch or remediation level is stated in the advisory, but Oracle's July 2026 Critical Patch Update includes multiple patches and strongly recommends applying updates promptly.

Successful exploitation can lead to full compromise of Oracle Access Manager, affecting confidentiality, integrity, and availability of the system. This could allow an attacker to take over authentication processes and potentially gain unauthorized access to protected resources managed by Oracle Access Manager.

Oracle has released a Critical Patch Update in July 2026 addressing multiple vulnerabilities including this one. Although no specific patch link or remediation level is provided for CVE-2026-60325, Oracle strongly recommends applying the July 2026 Critical Patch Update promptly to mitigate this vulnerability. Users should verify patch availability and installation instructions from the official Oracle advisory at https://www.oracle.com/security-alerts/cpujul2026.html. No alternative mitigations or workarounds are specified.