CVE-2026-60323 in Identity Manager
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Identity Manager's Legacy User Interface component of Oracle Fusion Middleware, specifically affecting versions 12.2.1.4.0 and 14.1.2.1.0. The flaw represents a critical security weakness that enables low-privileged attackers to exploit network-based HTTP access points to compromise the entire Oracle Identity Manager system. The vulnerability's ease of exploitation means that attackers with minimal privileges can leverage this weakness to gain significant unauthorized access capabilities. The CVSS 3.1 base score of 8.1 indicates a high-severity threat with substantial impact on both confidentiality and integrity aspects of the affected system.
The technical nature of this vulnerability stems from insufficient authorization controls within the legacy user interface component, allowing malicious actors to manipulate system functions through HTTP requests without proper authentication or access validation. This weakness creates a pathway for attackers to perform unauthorized operations including data creation, deletion, and modification activities against critical organizational data stored within Oracle Identity Manager. The vulnerability's impact extends beyond simple data manipulation to potentially enable complete access to all accessible data within the system, making it particularly dangerous for organizations relying on proper identity management controls. This type of flaw typically falls under CWE-284 (Improper Access Control) or similar authorization-related weakness categories within the Common Weakness Enumeration framework.
Operationally, this vulnerability poses severe risks to enterprise identity management systems where Oracle Identity Manager serves as a critical component for user authentication and access control. Organizations utilizing these affected versions face potential data breaches that could compromise sensitive user credentials, access rights, and identity information. The unauthorized modification capabilities mean attackers could alter user permissions, create fraudulent accounts, or manipulate access controls to maintain persistent access to the system. The lack of user interaction requirement (UI:N in CVSS vector) indicates that exploitation can occur entirely through automated network-based attacks without requiring user deception or additional social engineering tactics.
Organizations should immediately implement mitigations including patching affected systems to the latest supported versions, implementing network segmentation to limit access to Oracle Identity Manager components, and strengthening authentication controls. Additional protective measures involve deploying web application firewalls to monitor and filter HTTP traffic, enforcing strict access controls for administrative functions, and conducting regular security assessments of identity management systems. The ATT&CK framework would categorize this vulnerability under privilege escalation techniques where attackers leverage weaknesses in access control mechanisms to gain elevated system privileges. Security monitoring should focus on detecting anomalous HTTP requests targeting legacy UI components, particularly those attempting unauthorized data modification operations, as these activities could indicate exploitation attempts against the vulnerable Oracle Identity Manager installation.