CVE-2026-60355 is a vulnerability in the Authentication Engine component of Oracle Access Manager within Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.1.0. The flaw allows an unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager, potentially leading to complete takeover of the system. The vulnerability has a CVSS 3.1 score of 9.8 with attack vector network, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly confirm patch availability or remediation status for this specific issue. Oracle emphasizes the importance of applying security patches without delay to prevent exploitation.

Successful exploitation of this vulnerability can lead to full compromise of Oracle Access Manager, impacting confidentiality, integrity, and availability of the system. An attacker can take over the Oracle Access Manager without authentication, which may allow unauthorized access to protected resources and administrative control over the authentication infrastructure.

Oracle has released a Critical Patch Update in July 2026 that addresses multiple vulnerabilities including this one. Although the advisory does not explicitly confirm a patch for CVE-2026-60355, Oracle strongly recommends that customers apply the latest Critical Patch Updates promptly. There is no indication that this vulnerability is already mitigated or requires no action. Therefore, affected organizations should monitor Oracle's advisory closely and apply patches as soon as they become available to remediate this vulnerability.