CVE-2026-60567: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-60567 Overview

CVE-2026-60567 is a critical vulnerability in Oracle Identity Manager (OIM), a component of Oracle Fusion Middleware. The flaw resides in the OIM Legacy UI component and affects supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via HTTP can exploit this vulnerability without user interaction. Successful exploitation allows attackers to create, delete, or modify critical data and gain complete read access to all data accessible through Oracle Identity Manager. Oracle disclosed the issue in its July 2026 Critical Patch Update advisory.

Critical Impact
Unauthenticated remote attackers can compromise identity governance data, manipulate user accounts, and access sensitive identity records across the entire Oracle Identity Manager deployment.

Affected Products

Oracle Identity Manager 12.2.1.4.0
Oracle Identity Manager 14.1.2.1.0
Oracle Fusion Middleware deployments using the OIM Legacy UI component

Discovery Timeline

2026-07-21 - CVE-2026-60567 published to the National Vulnerability Database
2026-07-21 - Last updated in NVD database
July 2026 - Oracle released a fix as part of the July 2026 Critical Patch Update

Technical Details for CVE-2026-60567

Vulnerability Analysis

The vulnerability affects the OIM Legacy UI component of Oracle Identity Manager. According to Oracle's advisory, the flaw is easily exploitable over HTTP by an unauthenticated attacker. The CVSS vector indicates high confidentiality and integrity impact with no availability impact, meaning the primary risk is unauthorized data disclosure and manipulation rather than service disruption.

Oracle Identity Manager governs user provisioning, role assignment, and access certification across enterprise applications. A compromise of OIM can cascade into unauthorized access across every downstream system it manages. This scope makes the flaw particularly consequential for enterprises using OIM as their central identity governance platform.

Root Cause

Oracle has not published detailed root cause information in the public advisory. The affected component is the OIM Legacy UI, a web-facing interface exposed over HTTP. The attack requires no privileges and no user interaction, which points to a missing authentication or access control check on a network-reachable endpoint rather than a memory safety issue.

Attack Vector

An attacker sends crafted HTTP requests to the OIM Legacy UI endpoint over the network. Because authentication is not required, any adversary with network reachability to the OIM instance can attempt exploitation. Successful requests grant the attacker the ability to read, modify, create, or delete records held by Oracle Identity Manager, including user accounts, role definitions, and entitlement data.

Refer to the Oracle Security Alert July 2026 for authoritative technical details.

Detection Methods for CVE-2026-60567

Indicators of Compromise

Unauthenticated HTTP requests to OIM Legacy UI endpoints originating from unexpected source addresses
Unusual account creation, modification, or deletion events in Oracle Identity Manager audit logs
Role and entitlement changes not tied to an authenticated administrator session
Bulk read operations against identity data outside of scheduled reconciliation windows

Detection Strategies

Correlate OIM audit events with authenticated session identifiers to surface changes lacking a valid administrator context
Alert on HTTP requests to Legacy UI paths from network segments that should not reach the OIM management plane
Baseline normal administrative activity volume and flag statistical deviations in account or role operations
Review web server and application logs for anomalous request patterns targeting OIM Legacy UI URIs

Monitoring Recommendations

Forward Oracle Identity Manager audit logs and WebLogic access logs to a centralized SIEM for continuous analysis
Monitor identity governance workflows for out-of-band changes to privileged roles and administrative accounts
Track outbound authentication events downstream of OIM for suspicious access following identity changes
Enable alerting on any modification to identity governance data outside approved change windows

How to Mitigate CVE-2026-60567

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to all Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 instances
Restrict network access to the OIM Legacy UI to trusted administrative networks only
Audit recent identity governance changes for unauthorized account creation, modification, or deletion
Rotate credentials and reassess entitlements for accounts modified through OIM in the exposure window

Patch Information

Oracle addressed CVE-2026-60567 in the July 2026 Critical Patch Update. Administrators should download and apply the relevant patches for Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 as documented in the Oracle Security Alert July 2026.

Workarounds

Place the OIM Legacy UI behind a reverse proxy that enforces IP allowlisting for administrative sources
Disable or block the Legacy UI component if it is not required for operational workflows
Enforce web application firewall rules that block unauthenticated access attempts to Legacy UI endpoints
Segment the OIM management interface from general user network traffic using firewall policy

bash

# Example: restrict access to OIM Legacy UI at the network edge
# Replace 10.0.0.0/24 with your authorized admin subnet
iptables -A INPUT -p tcp --dport 14000 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 14000 -j DROP