This vulnerability affects the Authentication Engine component of Oracle Access Manager in versions 12.2.1.4.0 and 14.1.2.1.0. It permits an unauthenticated attacker with network access over HTTP to compromise the system, potentially resulting in complete takeover. The CVSS 3.1 vector indicates network attack vector with high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Oracle's July 2026 Critical Patch Update advisory references this vulnerability among many others but does not explicitly state a dedicated patch or remediation level for it. The vulnerability is classified under CWE-287 (Improper Authentication). No known exploits in the wild have been reported.

Successful exploitation of this vulnerability can lead to full compromise of Oracle Access Manager, allowing an attacker to gain unauthorized control over the system. This impacts confidentiality, integrity, and availability of the affected product. Given the critical role of Oracle Access Manager in authentication and access control, such a compromise could have significant security consequences for organizations relying on it.

Oracle's July 2026 Critical Patch Update advisory recommends applying the latest security patches without delay. Although no explicit patch or remediation level is confirmed for CVE-2026-60416 in the advisory, customers should ensure they are running actively supported versions and promptly apply all relevant Critical Patch Updates from Oracle. Monitor Oracle's official security alerts for updates on patch availability and further guidance.