This vulnerability affects the Authentication Engine component of Oracle Access Manager in versions 12.2.1.4.0 and 14.1.2.1.0. It is easily exploitable by unauthenticated attackers over HTTP, allowing them to compromise Oracle Access Manager and potentially gain unauthorized access to critical or all accessible data. The vulnerability has a CVSS 3.1 score of 8.6, indicating a high impact on confidentiality with no required privileges or user interaction. The scope of impact extends beyond Oracle Access Manager to other Oracle products. Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state patch availability or remediation details for it. No known exploits in the wild have been reported.

Successful exploitation of this vulnerability can result in unauthorized access to critical data or complete access to all data accessible via Oracle Access Manager. The confidentiality of sensitive information is severely impacted. There is no reported impact on integrity or availability. The vulnerability also has a scope change, meaning it may affect additional Oracle products beyond Oracle Access Manager.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm the availability of a specific patch or remediation for CVE-2026-60559. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Applying the latest security patches from Oracle promptly is recommended to mitigate this vulnerability. Since no official fix status is explicitly stated, patch status is not yet confirmed—check the vendor advisory for current remediation guidance.