CVE-2026-61196 in Identity Manager
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Identity Manager's legacy user interface component of the Fusion Middleware suite, representing a critical security flaw that affects specifically version 12.2.1.4.0 and 14.1.2.1.0. The vulnerability stems from insufficient authentication mechanisms within the legacy web interface, allowing attackers to exploit the system without requiring valid credentials or prior access privileges. This represents a fundamental failure in the principle of least privilege and authentication controls that should normally protect enterprise identity management systems.
The technical nature of this flaw lies in the lack of proper access control validation within the OIM Legacy UI components, enabling unauthenticated HTTP requests to traverse the system's security boundaries. Attackers can leverage this weakness through standard network-based exploitation techniques, making it particularly dangerous as it requires no specialized tools or insider knowledge beyond basic network connectivity. The vulnerability's CVSS score of 9.8 reflects its severe impact across all three core security principles: confidentiality, integrity, and availability, indicating that successful exploitation would provide complete system compromise.
The operational implications of this vulnerability are devastating for organizations relying on Oracle Identity Manager for critical identity management functions. An attacker who successfully exploits this vulnerability gains full administrative control over the identity management system, potentially compromising thousands of user accounts and their associated permissions. This could lead to unauthorized access to sensitive corporate data, privilege escalation across multiple systems, and complete disruption of identity governance processes. The impact extends beyond immediate system compromise to include potential lateral movement within the enterprise network, as identity management systems often serve as central points for access control.
Organizations should immediately implement network-level mitigations including firewall restrictions that block direct access to the affected legacy UI components from untrusted networks. Patch management procedures must be prioritized to ensure timely deployment of Oracle's security patches addressing this vulnerability. Network segmentation strategies should isolate critical identity management systems from general network traffic, while implementing robust monitoring and logging mechanisms to detect unauthorized access attempts. This vulnerability aligns with CWE-284 (Improper Access Control) and maps to ATT&CK technique T1078 (Valid Accounts) and T1566 (Phishing), emphasizing the need for comprehensive security controls beyond simple patching approaches. Regular security assessments should verify that legacy components are properly secured or appropriately decommissioned, as this vulnerability demonstrates the risks associated with maintaining outdated interfaces within enterprise security architectures.