This vulnerability in Oracle Access Manager's Authentication Engine allows an unauthenticated attacker with network access via HTTP to compromise the product. The attack can result in unauthorized access to critical or all data accessible through Oracle Access Manager. The vulnerability affects versions 12.2.1.4.0 and 14.1.2.1.0. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, scope change, and high confidentiality impact without integrity or availability impact. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm patch availability or remediation level for this specific issue. Customers are strongly advised to apply Oracle Critical Patch Updates promptly to mitigate risks.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible via Oracle Access Manager. The confidentiality of sensitive information is severely impacted. There is no direct impact on integrity or availability according to the CVSS vector. The vulnerability also has a scope change, meaning it may affect additional Oracle products beyond Oracle Access Manager.

Oracle has released a Critical Patch Update advisory in July 2026 that addresses this vulnerability among others. However, the specific patch or remediation status for CVE-2026-60327 is not explicitly stated in the advisory content provided. Customers should review the July 2026 Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for detailed patch availability and installation instructions. Oracle strongly recommends applying security patches without delay and remaining on actively-supported versions. Patch status is not yet confirmed explicitly for this vulnerability; therefore, check the vendor advisory for current remediation guidance.