CVE-2026-60323: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-60323 Overview

CVE-2026-60323 affects the Oracle Identity Manager (OIM) product within Oracle Fusion Middleware, specifically the OIM Legacy UI component. The vulnerability impacts supported versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with network access via HTTP can exploit this flaw to compromise Oracle Identity Manager. Successful exploitation permits unauthorized creation, deletion, or modification of critical data, and grants unauthorized read access across all data accessible to Oracle Identity Manager. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Authenticated attackers can read, create, modify, and delete identity data across the OIM tenant over the network, undermining the integrity and confidentiality of enterprise identity governance.

Affected Products

Oracle Identity Manager 12.2.1.4.0
Oracle Identity Manager 14.1.2.1.0
Oracle Fusion Middleware (OIM Legacy UI component)

Discovery Timeline

2026-07-21 - CVE-2026-60323 published to NVD
2026-07-23 - Last updated in NVD database
July 2026 - Oracle publishes fix in the Oracle July 2026 Security Alert

Technical Details for CVE-2026-60323

Vulnerability Analysis

The flaw resides in the OIM Legacy UI component of Oracle Identity Manager. An attacker holding low-privileged credentials can send crafted HTTP requests to the legacy interface and act on data outside their authorization scope. Oracle categorizes the impact against confidentiality and integrity as high, with no availability impact. Because attack complexity is low and user interaction is not required, the vulnerability lends itself to scripted exploitation across exposed OIM deployments.

Oracle Identity Manager governs provisioning, reconciliation, and role assignment for enterprise identities. A compromise at this layer allows an adversary to influence downstream systems that trust OIM as the authoritative identity source.

Root Cause

Oracle has not published detailed root-cause information beyond the advisory. The vulnerability sits within the OIM Legacy UI request handling path and stems from insufficient authorization enforcement on privileged operations exposed to authenticated users. Consult the Oracle July 2026 Security Alert for vendor-provided technical detail.

Attack Vector

The attack vector is network-based over HTTP. The attacker must hold a valid low-privileged account on the target OIM instance. No user interaction is required. Once authenticated, the attacker issues requests to the Legacy UI endpoints to reach data and operations they should not be authorized to invoke, resulting in unauthorized read and write access to OIM-accessible data.

No public proof-of-concept has been observed at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is 0.296%.

Detection Methods for CVE-2026-60323

Indicators of Compromise

Unexpected create, modify, or delete operations against OIM user, role, or entitlement objects performed by low-privileged accounts.
HTTP requests to Legacy UI paths originating from accounts that do not normally interact with those endpoints.
Bulk read access to user, role, or policy data outside of the account's usual scope.

Detection Strategies

Correlate OIM audit logs with Access Manager authentication events to identify low-privileged sessions issuing administrative operations.
Alert on Legacy UI request patterns that deviate from historical baselines for each account role.
Compare provisioning and reconciliation events against approved change requests to surface unauthorized modifications.

Monitoring Recommendations

Forward OIM application, WebLogic access, and audit logs to a centralized SIEM for correlation and retention.
Monitor identity governance workflows for out-of-band role grants, entitlement changes, and account creations.
Track HTTP 4xx and 5xx response spikes against Legacy UI endpoints as a signal of enumeration or exploitation attempts.

How to Mitigate CVE-2026-60323

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to OIM 12.2.1.4.0 and 14.1.2.1.0 deployments.
Restrict network exposure of the OIM Legacy UI to trusted administrative networks and VPN segments.
Audit all OIM accounts and remove or downgrade unused low-privileged accounts that could be leveraged for exploitation.
Rotate credentials for service and integration accounts that authenticate to OIM.

Patch Information

Oracle addressed CVE-2026-60323 in the July 2026 Critical Patch Update. Refer to the Oracle July 2026 Security Alert for patch identifiers, applicability matrices, and installation instructions specific to each supported version.

Workarounds

Disable or block access to the OIM Legacy UI component where operations can be handled through the modern Identity Self Service interface.
Place a reverse proxy or web application firewall in front of OIM to restrict Legacy UI paths to administrator IP ranges.
Enforce multi-factor authentication on all OIM accounts to raise the cost of credential-based access required for exploitation.

bash

# Example: restrict OIM Legacy UI to an administrative network at the reverse proxy
# Replace 10.10.0.0/16 with your administrative CIDR
location /oim/faces/ {
    allow 10.10.0.0/16;
    deny all;
    proxy_pass https://oim-backend.internal;
}