CVE-2026-60560: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-60560 Overview

CVE-2026-60560 affects the REST WebServices component of Oracle Identity Manager, part of Oracle Fusion Middleware. The flaw allows a low-privileged attacker with network access over HTTP to compromise the identity management platform. Successful exploitation enables unauthorized creation, deletion, or modification of data, and unauthorized read access to all data accessible through Oracle Identity Manager. Oracle disclosed the issue in the Oracle Security Alert July 2026.

Critical Impact
An authenticated attacker with low privileges can read and modify all data accessible through Oracle Identity Manager, undermining the integrity of the enterprise identity governance layer.

Affected Products

Oracle Identity Manager 12.2.1.4.0
Oracle Identity Manager 14.1.2.1.0
Oracle Fusion Middleware — REST WebServices component

Discovery Timeline

2026-07-21 - CVE-2026-60560 published to the National Vulnerability Database
2026-07-21 - Oracle Security Alert July 2026 released
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-60560

Vulnerability Analysis

CVE-2026-60560 resides in the REST WebServices component of Oracle Identity Manager. The vulnerability is remotely exploitable over HTTP and requires only low-level authentication. No user interaction is required, and exploitation does not depend on complex preconditions.

Successful exploitation grants an attacker unauthorized read access and unauthorized write access to all data accessible by Oracle Identity Manager. Because Oracle Identity Manager governs user provisioning, entitlements, and access certifications across enterprise systems, compromise of the REST layer can propagate to any downstream system it manages. Availability of the service is not directly impacted, according to the published CVSS vector.

Root Cause

The advisory does not disclose the specific class of defect in the REST WebServices layer. The impact profile — low-privileged network access producing full read and write compromise — is consistent with a broken access control or authorization bypass condition in one or more REST endpoints. In such patterns, a request from an authenticated but unprivileged principal is accepted by an endpoint that fails to enforce role or scope restrictions on the requested resource.

Attack Vector

An attacker requires only a low-privileged account and HTTP network reachability to the Oracle Identity Manager REST interface. From there, the attacker issues crafted HTTP requests to REST endpoints in the identity management API surface. Because Oracle Identity Manager is often exposed to internal user populations and integrated with SSO, the population of accounts capable of exploiting the flaw is typically large.

No public proof-of-concept code has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Oracle Security Alert July 2026 for vendor technical details.

Detection Methods for CVE-2026-60560

Indicators of Compromise

Unexpected HTTP requests from low-privileged user accounts to Oracle Identity Manager REST endpoints under /iam/, /identity/, or /idmui/ paths.
Creation, modification, or deletion of Oracle Identity Manager users, roles, or entitlements outside approved change windows.
Anomalous spikes in REST API traffic to Oracle Identity Manager originating from a single session or account.
Audit log entries showing privileged operations executed by accounts without the corresponding administrative role.

Detection Strategies

Correlate Oracle Identity Manager audit logs with WebLogic access logs to identify REST calls whose effective privilege exceeds the caller's assigned role.
Baseline normal REST endpoint usage per user role, then alert on deviations such as low-privileged users invoking user-management or role-assignment APIs.
Monitor for out-of-band changes to identity data by reconciling Oracle Identity Manager state against authoritative HR or directory sources.

Monitoring Recommendations

Enable verbose auditing on all Oracle Identity Manager REST WebServices and forward logs to a centralized SIEM.
Track authentication events for service and low-privilege accounts, and flag any interaction with administrative REST paths.
Alert on bulk read operations against user, role, or policy objects that fall outside expected reporting workflows.

How to Mitigate CVE-2026-60560

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 deployments.
Restrict network reachability of the Oracle Identity Manager REST interface to trusted management networks and known integration hosts.
Review and revoke unnecessary low-privileged accounts that can authenticate to Oracle Identity Manager.
Audit recent Oracle Identity Manager user, role, and entitlement changes for unauthorized modifications.

Patch Information

Oracle addressed CVE-2026-60560 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert July 2026 advisory for the exact patch identifiers and installation procedure for each affected release. Patching is the only vendor-supported remediation.

Workarounds

Place a reverse proxy or web application firewall in front of Oracle Identity Manager and block low-privileged accounts from reaching sensitive REST paths until patching is complete.
Enforce network segmentation so that only jump hosts and approved integrations can reach the Oracle Identity Manager HTTP listener.
Rotate credentials for any low-privileged accounts that may have been exposed, and increase audit retention until patch validation is complete.

bash

# Example: restrict access to the Oracle Identity Manager REST path at the reverse proxy
# (Adjust IP ranges and paths for your environment; not a substitute for patching)
location /iam/ {
    allow 10.20.0.0/24;   # identity administration subnet
    deny  all;
    proxy_pass https://oim-backend.internal:14000;
}