Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the hardware where the Oracle Access Manager executes to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-60146 is a vulnerability in Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0. It allows an unauthenticated attacker with network access via HTTP to compromise the product. Successful exploitation requires human interaction from a person other than the attacker and can lead to unauthorized update, insert, delete, and read access to some Oracle Access Manager data. The vulnerability impacts confidentiality and integrity with a CVSS 3.1 base score of 6.1. Oracle has published a Critical Patch Update advisory addressing this and other vulnerabilities but does not explicitly confirm patch availability for this specific issue in the provided content.
Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). The supported version that is affected is 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Access Manager. Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-35314 is a high-severity vulnerability in Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0. It allows an unauthenticated attacker with network access via HTTP to perform unauthorized update, insert, or delete operations on some accessible data, read a subset of accessible data, and cause a partial denial of service. The vulnerability affects the Web Server Plugin component of Oracle Fusion Middleware. The CVSS 3.1 base score is 7.3, reflecting impacts on confidentiality, integrity, and availability. Oracle has released a Critical Security Patch Update advisory recommending prompt patch application to mitigate this and other vulnerabilities. No explicit patch or fix version is stated in the advisory content provided.
CVE-2026-35313 is a critical vulnerability in Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0. It allows a low privileged attacker with network access via HTTP to compromise Oracle Access Manager, potentially leading to full takeover. The vulnerability impacts confidentiality, integrity, and availability with a CVSS score of 9.9. Attacks exploiting this flaw may also affect additional Oracle products due to scope change. Oracle has released a Critical Security Patch Update advisory recommending prompt patching and mitigation steps to reduce risk until patches are applied.
CVE-2026-35261 is a vulnerability in Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 that allows an unauthenticated attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized read, update, insert, or delete access to certain Oracle Access Manager data. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. Oracle has included this vulnerability in its June 2026 Critical Security Patch Update and strongly recommends applying the patches promptly. No specific patch version is stated in the provided data, but the vendor advisory emphasizes applying the Critical Security Patch Update without delay. Workarounds such as blocking network protocols or removing unnecessary privileges may reduce risk temporarily but could impact functionality.