CVE-2026-60720 in Identity Manager
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. While the vulnerability is in Oracle Identity Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Oracle Identity Manager product, specifically affecting its Legacy User Interface component in versions 12.2.1.4.0 and 14.1.2.1.0 of the Oracle Fusion Middleware suite. This security flaw represents a critical risk to organizations relying on these specific releases for identity and access management operations. The vulnerability is characterized by an easily exploitable condition that allows attackers with low privileges and network access via HTTP to compromise the integrity, confidentiality, and availability of the target system. Because this component handles sensitive authentication and authorization logic, its compromise can lead to a complete takeover of the Oracle Identity Manager environment.
The technical nature of this flaw enables unauthorized actors to bypass standard security controls due to insufficient input validation or improper access control mechanisms within the legacy UI layer. An attacker does not require high-level privileges or user interaction to exploit this condition, as it is remotely exploitable over HTTP without any need for visual interface manipulation by a victim. This low barrier to entry significantly increases the likelihood of successful exploitation in environments where network segmentation is weak or internal trust models are overly permissive. The ability to execute attacks with minimal prerequisites underscores the severity of the design flaw within this specific version of the software.
The operational impact of exploiting this vulnerability extends beyond the immediate Oracle Identity Manager instance, indicating a scope change that affects additional products and services integrated with it. Since identity management systems serve as central hubs for authentication across enterprise ecosystems, compromising them can lead to lateral movement throughout the network. Attackers who gain control over Oracle Identity Manager can manipulate user accounts, alter access policies, or extract sensitive credential data. This results in a catastrophic loss of confidentiality, integrity, and availability, effectively granting the attacker administrative dominance over critical infrastructure components that depend on accurate identity assertions.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication and CWE-269 Unauthorized Privilege Escalation, as it allows low-privileged users to achieve high-level control. In terms of offensive security frameworks, the exploit path corresponds to MITRE ATT&CK techniques involving Initial Access via valid accounts or service credentials, followed by Lateral Movement and Defense Evasion through manipulation of identity stores. The CVSS 3.1 base score of 9.9 reflects these severe impacts, with high scores across confidentiality, integrity, and availability vectors due to the potential for total system compromise.
Mitigation strategies must prioritize immediate patching or upgrading Oracle Identity Manager to a version where this legacy UI vulnerability has been remediated. Organizations should also implement strict network segmentation to restrict HTTP access to identity management interfaces from untrusted networks. Additionally, deploying web application firewalls with rules tailored to detect exploitation patterns associated with this flaw can provide an additional layer of defense. Regular auditing of privileged accounts and monitoring for anomalous authentication activities are essential operational controls to detect potential compromise attempts before they result in full system takeover.