CVE-2026-61197 in Identity Manager
Summary
by MITRE • 07/22/2026
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/22/2026
This vulnerability resides within Oracle Identity Manager's Legacy User Interface component of Oracle Fusion Middleware, representing a critical security flaw affecting versions 12.2.1.4.0 and 14.1.2.1.0. The vulnerability manifests as an authentication bypass issue that allows unauthenticated attackers to gain unauthorized access to the system through HTTP network connections. The CVSS 3.1 score of 9.1 indicates a high-severity threat with significant impact on both confidentiality and integrity, reflecting the potential for extensive data compromise and modification capabilities.
The technical exploitation of this vulnerability occurs through network-based attacks that do not require authentication credentials or privileged access levels. Attackers can leverage the flaw to perform unauthorized operations including creating, deleting, or modifying critical system data within Oracle Identity Manager. This unauthenticated access extends to all data accessible through the vulnerable component, potentially enabling attackers to gain complete visibility into user identities, access controls, and sensitive organizational information stored within the identity management system.
The operational impact of this vulnerability is substantial as it undermines the fundamental security controls of Oracle Identity Manager, which serves as a critical component for managing user identities and access permissions within enterprise environments. Successful exploitation can result in unauthorized data modification, complete data disclosure, and potential lateral movement within the network infrastructure. Organizations relying on Oracle Identity Manager for identity governance may experience severe consequences including regulatory compliance violations, data breaches, and disruption of business operations. The vulnerability's classification under CWE-287 (Improper Authentication) and its alignment with ATT&CK technique T1078 (Valid Accounts) highlights the critical nature of this flaw in compromising system integrity.
Mitigation strategies should prioritize immediate patching of affected Oracle Identity Manager versions to address the authentication bypass vulnerability. Organizations must implement network segmentation and access controls to limit exposure of the vulnerable Legacy UI component, while also monitoring for suspicious network activity and unauthorized access attempts. Additional defensive measures include disabling unnecessary HTTP services, implementing robust network monitoring solutions, and conducting comprehensive security assessments to identify potential exploitation attempts. Regular vulnerability scanning and penetration testing should be performed to ensure continued protection against similar threats and to validate the effectiveness of implemented security controls.