CVE-2026-60333 is a vulnerability in the Authentication Engine component of Oracle Access Manager within Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.1.0. The flaw allows a low privileged attacker with network access over HTTP to compromise Oracle Access Manager, potentially resulting in complete takeover of the system. The vulnerability has a CVSS 3.1 score of 9.9 with vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating network exploitable with low attack complexity, requiring low privileges, no user interaction, and causing high confidentiality, integrity, and availability impacts with scope change. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state patch availability or remediation details for it. No known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to complete compromise of Oracle Access Manager, affecting confidentiality, integrity, and availability of the system. Due to scope change, the impact may extend to additional Oracle products integrated with or dependent on Oracle Access Manager. This could allow attackers to take over authentication processes and potentially gain unauthorized access to protected resources.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm the availability of a specific patch or remediation for CVE-2026-60333. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Applying the latest security patches from Oracle promptly is recommended to mitigate this vulnerability. Since this is not a cloud service, remediation depends on customers applying patches. Patch status is not yet confirmed explicitly for this vulnerability—check the vendor advisory for current remediation guidance.