Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. While the vulnerability is in Oracle Access Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Access Manager. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD published the first details for CVE-2026-60358
A CVSS base score of 10 has been assigned.
Feedly found the first article mentioning CVE-2026-60358 . See article
Oracle Issues Record-Breaking July 2026 Security Update with 1,449 Patches
Oracle July 2026 CPU: pre-auth 10.0 RCE in WebLogic + more
Oracle Critical Patch Update Advisory
CVE-2026-60358 | Oracle Access Manager 12.2.1.4.0/14.1.2.1.0 Authentication Engine Remote Code Execution
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
