This vulnerability exists in the Authentication Engine component of Oracle Access Manager within Oracle Fusion Middleware. It is easily exploitable remotely without authentication, allowing an attacker to compromise Oracle Access Manager completely. The vulnerability has a CVSS 3.1 score of 10.0, indicating critical impact on confidentiality, integrity, and availability. The advisory notes that successful exploitation can lead to takeover of Oracle Access Manager and may affect other Oracle products. The affected versions explicitly stated are 12.2.1.4.0 and 14.1.2.1.0. The vendor advisory is a Critical Patch Update from July 2026, which includes many patches but does not explicitly confirm patch availability or remediation level for this specific vulnerability in the provided excerpt.

Successful exploitation allows an unauthenticated remote attacker to fully compromise Oracle Access Manager, resulting in complete loss of confidentiality, integrity, and availability of the product. This can lead to takeover of Oracle Access Manager and potentially impact other Oracle products due to the scope change. The CVSS 3.1 score of 10.0 reflects the critical severity and the broad impact on system security.

The vendor advisory is a Critical Patch Update from July 2026 that addresses multiple vulnerabilities including this one. However, the provided advisory content does not explicitly confirm patch availability or remediation status for CVE-2026-60358. Customers are strongly advised to review the official Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch information and apply all relevant security patches promptly. Until confirmation of patch availability is obtained, organizations should consider risk mitigation strategies such as restricting network access to Oracle Access Manager and monitoring for suspicious activity. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.