CVE-2026-60327 is a vulnerability in the Authentication Engine component of Oracle Access Manager within Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.1.0. The flaw allows an unauthenticated attacker with network access over HTTP to compromise Oracle Access Manager, potentially resulting in unauthorized access to critical or all data accessible by the product. The vulnerability has a CVSS 3.1 score of 8.6, reflecting high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and a confidentiality impact classified as high. The vulnerability also has a scope change, meaning it may affect other Oracle products integrated with or dependent on Oracle Access Manager. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state whether a patch is available or provide specific remediation instructions for it.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain unauthorized access to critical or all data accessible through Oracle Access Manager. This compromises confidentiality but does not impact integrity or availability. The vulnerability's scope change indicates that exploitation could affect additional Oracle products beyond Oracle Access Manager itself.

Oracle's July 2026 Critical Patch Update advisory includes this vulnerability in its security updates. However, the advisory content provided does not explicitly confirm the availability of a patch or remediation for CVE-2026-60327. Therefore, patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying all relevant security patches promptly and remaining on actively supported versions to mitigate exploitation risks.