CVE-2026-60329: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-60329 Overview

CVE-2026-60329 is an unauthenticated remote vulnerability in the Oracle Identity Manager (OIM) Legacy UI component of Oracle Fusion Middleware. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.1.0. An attacker with network access via the T3 or Internet Inter-ORB Protocol (IIOP) can compromise Oracle Identity Manager without credentials or user interaction. Successful exploitation results in full takeover of the identity management platform, impacting confidentiality, integrity, and availability. Oracle disclosed the issue in the July 2026 Critical Patch Update.

Critical Impact
Unauthenticated network attackers can take over Oracle Identity Manager, granting control over enterprise identity provisioning, authentication workflows, and privileged account lifecycles.

Affected Products

Oracle Identity Manager 12.2.1.4.0
Oracle Identity Manager 14.1.2.1.0
Oracle Fusion Middleware — OIM Legacy UI component

Discovery Timeline

2026-07-21 - CVE-2026-60329 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60329

Vulnerability Analysis

CVE-2026-60329 resides in the OIM Legacy UI component of Oracle Identity Manager. The vulnerability is reachable over the T3 and IIOP protocols, both used by Oracle WebLogic Server for remote method invocation and cluster communication. An attacker requires only network reachability to these listener ports to interact with the vulnerable component. No prior authentication, user interaction, or privileged context is required.

Exploitation results in complete takeover of the Oracle Identity Manager instance. Because OIM controls identity provisioning, role management, and downstream account synchronization, compromise cascades into the entire identity fabric of an organization. Successful attacks can produce arbitrary account creation, credential theft, and modification of authorization data across integrated systems.

Root Cause

Oracle has not published detailed root-cause information. Historically, unauthenticated T3 and IIOP vulnerabilities in Oracle Fusion Middleware have stemmed from unsafe deserialization of Java objects transmitted over these protocols. Refer to the Oracle Security Alert July 2026 for authoritative details.

Attack Vector

The attack vector is network-based. The attacker sends crafted T3 or IIOP requests to the WebLogic listener hosting Oracle Identity Manager. Because these protocols are commonly exposed for management and clustering, misconfigured or internet-facing deployments increase exposure. Environments that expose T3/IIOP beyond trusted management networks are at highest risk.

No verified proof-of-concept code is publicly available at the time of publication. The EPSS score is 0.358% at the 28th percentile, indicating limited observed exploitation activity to date. Refer to Oracle's advisory for exploitation prerequisites and technical details.

Detection Methods for CVE-2026-60329

Indicators of Compromise

Unexpected inbound connections to WebLogic T3 listener ports (default 7001) or IIOP ports from untrusted sources.
New or modified OIM administrative accounts, roles, or entitlements without corresponding change tickets.
Anomalous Java process activity spawned by the WebLogic managed server hosting OIM, including shell or scripting engine invocations.
Outbound network callbacks from the OIM host to previously unseen infrastructure following T3/IIOP traffic.

Detection Strategies

Inspect WebLogic access and audit logs for T3/IIOP requests targeting OIM Legacy UI endpoints from non-management sources.
Correlate WebLogic AdminServer.log and OIM audit events with process creation telemetry on the underlying host.
Alert on serialized Java payload signatures traversing T3/IIOP flows using network detection tooling.

Monitoring Recommendations

Baseline expected T3/IIOP peers and alert on deviations, particularly connections originating outside the identity management network segment.
Monitor for new child processes of the WebLogic JVM, such as cmd.exe, powershell.exe, /bin/sh, or bash.
Track privileged operations inside OIM including role assignment changes, workflow modifications, and connector reconfigurations.

How to Mitigate CVE-2026-60329

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 without delay.
Restrict T3 and IIOP protocol access to trusted management networks using WebLogic Connection Filters and perimeter firewalls.
Review OIM administrative accounts, role assignments, and recent provisioning activity for unauthorized changes.

Patch Information

Oracle addressed CVE-2026-60329 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert July 2026 for patch identifiers, prerequisite bundles, and post-installation validation steps. Apply the fix in non-production environments first, validate custom OIM connectors and workflows, then promote to production.

Workarounds

Configure WebLogic Connection Filters (weblogic.security.net.ConnectionFilterImpl) to deny T3 and IIOP from all sources except explicitly trusted hosts.
Disable IIOP on the OIM managed server if the protocol is not required by integrations.
Place OIM behind a reverse proxy or bastion segment and block direct exposure of WebLogic administrative ports to user or internet-facing networks.

bash

# WebLogic Connection Filter example — restrict T3/IIOP to trusted subnet
# Set in WebLogic Console: Domain > Security > Filter
# Connection Filter: weblogic.security.net.ConnectionFilterImpl
# Connection Filter Rules:
10.10.20.0/24 * * allow t3 t3s iiop iiops
0.0.0.0/0    * * deny  t3 t3s iiop iiops