CVE-2026-60727 in Identity Manager
Summary
by MITRE • 08/19/2026
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/19/2026
The identified vulnerability resides within the Oracle Identity Manager product, specifically affecting its Legacy User Interface component in versions 12.2.1.4.0 and 14.1.2.1.0 of the Oracle Fusion Middleware suite. This security flaw represents a critical risk to organizations relying on these specific releases for identity and access management operations. The vulnerability is characterized by an unauthenticated attack vector, meaning that no valid credentials or prior authentication are required to initiate exploitation. An attacker with network access via HTTP can directly interact with the vulnerable interface components without needing to bypass any initial security gates such as login screens or session validation mechanisms. This lack of mandatory pre-authentication significantly lowers the barrier for entry, allowing malicious actors to target the system from remote locations over standard web protocols.
The technical nature of this flaw allows an attacker to achieve complete compromise of the Oracle Identity Manager instance. Successful exploitation leads directly to a takeover of the application environment, granting the adversary elevated privileges that effectively equate to administrative control. This level of access enables the manipulation of identity data, modification of user roles and permissions, and potential lateral movement within the broader enterprise network if the IDM server is integrated with other critical systems. The severity of this impact is quantified by a CVSS 3.1 Base Score of 9.8 out of 10, indicating a Critical severity level. This high score reflects the maximum possible impact on confidentiality, integrity, and availability, as an attacker can read sensitive identity data, alter configuration settings to maintain persistence or escalate privileges further, and disrupt service availability by manipulating core system functions.
From a classification perspective, this vulnerability aligns with CWE-287, which describes Improper Authentication, specifically where the software does not properly verify that the claimed authentication credentials are valid before granting access. Furthermore, given the ability to take over an application instance remotely without user interaction or prior login, it maps closely to MITRE ATT&CK techniques associated with Initial Access and Privilege Escalation via unauthenticated API endpoints or legacy interface flaws. The use of HTTP rather than HTTPS in the attack vector description suggests that even if encryption is not strictly required for exploitation due to the nature of the flaw, traffic may be transmitted in cleartext depending on configuration, potentially exposing additional data during the exploit process.
The operational impact of this vulnerability extends beyond the immediate compromise of the Oracle Identity Manager service itself. Since IDM systems often serve as the central hub for authenticating users across multiple enterprise applications, a takeover can lead to widespread identity fraud, unauthorized access to downstream resources, and significant reputational damage. Attackers could create backdoor accounts, modify existing user permissions to grant themselves or others excessive privileges, or exfiltrate sensitive personal identifiable information stored within the directory services managed by Oracle Identity Manager. The absence of authentication requirements makes this vulnerability particularly dangerous in environments where legacy interfaces are exposed to internal networks that may not be strictly segmented from untrusted zones.
Mitigation strategies must prioritize immediate remediation due to the critical severity and ease of exploitation. Organizations running affected versions 12.2.1.4.0 or 14.1.2.1.0 should apply the latest security patches provided by Oracle as soon as possible, ensuring that all components related to the Legacy UI are updated to a version where this flaw has been resolved. In cases where patching is not immediately feasible due to operational constraints, temporary mitigations should be implemented at the network perimeter or application delivery controller level. These measures include restricting access to the specific URL paths associated with the vulnerable legacy interface to trusted IP addresses only, enforcing strict firewall rules that block external HTTP traffic to these endpoints, and ensuring that HTTPS is enforced for all administrative interfaces if applicable. Additionally, monitoring logs for unusual activity patterns indicative of unauthenticated exploitation attempts can help in detecting active attacks while remediation efforts are underway. Regular audits of exposed legacy components and the decommissioning of unnecessary UI features are also recommended to reduce the overall attack surface of the identity management infrastructure.