CVE-2026-60721 in Identity Manager
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Oracle Identity Manager product, specifically affecting its Legacy User Interface component in versions 12.2.1.4.0 and 14.1.2.1.0 of the Oracle Fusion Middleware suite. This security flaw represents a critical risk to organizations relying on these specific releases for identity and access management operations. The vulnerability is characterized by an unauthenticated attack vector, meaning that no valid credentials or prior authentication are required to initiate an exploit. An attacker with network access via HTTP can directly interact with the vulnerable interface components to trigger the underlying technical flaw. This lack of authentication requirement significantly lowers the barrier to entry for malicious actors, allowing them to target systems exposed on internal or external networks without needing to bypass initial security controls such as login screens or multi-factor authentication mechanisms.
From a technical perspective, this vulnerability enables an attacker to achieve complete compromise of the Oracle Identity Manager application environment. The severity is underscored by its CVSS 3.1 Base Score of 9.8, which indicates a critical level of risk due to high impacts on confidentiality, integrity, and availability. The specific vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms that the attack is network-based with low complexity, requires no user interaction, and results in high impact across all three security pillars when successful. Such a flaw typically stems from improper input validation or insecure direct object references within the legacy UI code path, allowing an attacker to execute arbitrary commands, escalate privileges, or manipulate system state directly through crafted HTTP requests. The ability to take over the application implies that the attacker gains control equivalent to the service account running the Oracle Identity Manager process, which often possesses extensive permissions across the identity management infrastructure.
The operational impact of this vulnerability is severe and far-reaching within an enterprise environment. Since Oracle Identity Manager serves as a central hub for managing user identities, roles, and access policies, its compromise can lead to widespread unauthorized access to downstream applications and systems managed by the platform. An attacker could potentially create new administrative accounts, modify existing permissions, or delete critical identity data, thereby disrupting business operations and violating compliance requirements related to data privacy and security controls. The high availability impact suggests that successful exploitation may also result in denial of service conditions, rendering the identity management infrastructure unavailable for legitimate users. This dual threat of unauthorized access and operational disruption makes it imperative for organizations to address this issue with urgency to maintain both the confidentiality of sensitive user data and the integrity of their access control frameworks.
In alignment with industry standards, this vulnerability maps closely to CWE-287, which describes Improper Authentication, as well as potential aspects of CWE-94, Code Injection, depending on the specific mechanism exploited within the legacy UI. From a tactical perspective, it aligns with MITRE ATT&CK techniques related to Initial Access via web applications and potentially Privilege Escalation if the compromised account allows for further lateral movement or privilege abuse within the identity management system. To mitigate this risk, organizations must immediately apply the latest security patches provided by Oracle for the affected versions 12.2.1.4.0 and 14.1.2.1.0. If patching is not immediately feasible, temporary mitigations should include restricting network access to the Oracle Identity Manager legacy UI components through firewall rules or web application firewalls that block known exploit patterns associated with this vulnerability. Additionally, monitoring logs for unusual HTTP requests targeting these endpoints can help in detecting attempted exploitation activities before a full compromise occurs.