Back cve.report

CVE-2026-60358 CVE Vulnerability Disclosures / 1d Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful att

cve.report • July 23, 2026

Problem Types: Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Access Manager.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in Oracle Coherence and Access Manager Disclosed Multiple vulnerabilities affecting Oracle Coherence and Oracle Access Manager have been disclosed. CVE-2026-60248 and CVE-2026-60295 are critical vulnerabilities in Oracle Coherence, allowing attackers to potentially take over the system. CVE-2026-60248 has a CVSS score of 9.3, while CVE-2026-60295 has a score of 8.5, indicating high risk. Both vulnerabilities require network access, with CVE-60248 allowing unauthenticated access. CVE-2026-60358, affecting Oracle Access Manager, has a CVSS score of 10.0, indicating a severe risk of remote code execution. All vulnerabilities were published on July 21, 2026, and Oracle has included them in its July 2026 Critical Patch Update advisory. However, the availability of patches for the affected versions is not confirmed. Organizations using these products are advised to monitor Oracle's channels for updates and apply patches promptly. 10 sources 71

Extracted Entities

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (1)

Platforms (2)