CVE-2026-60707: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-60707 Overview

CVE-2026-60707 is an improper access control vulnerability [CWE-284] in the Security component of Oracle Identity Manager, part of Oracle Fusion Middleware. Affected versions include 12.2.1.4.0 and 14.1.2.1.0. A high-privileged attacker with network access over HTTP can exploit the flaw to compromise Oracle Identity Manager. The vulnerability carries a scope change, meaning successful exploitation can impact components beyond Oracle Identity Manager itself. Attackers can gain unauthorized read, create, delete, or modify access to critical data across all data accessible by the product.

Critical Impact
Successful exploitation allows unauthorized modification and full access to critical identity data, with scope-change impact on additional Oracle products.

Affected Products

Oracle Identity Manager 12.2.1.4.0
Oracle Identity Manager 14.1.2.1.0
Oracle Fusion Middleware (Security component)

Discovery Timeline

2026-08-18 - CVE CVE-2026-60707 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60707

Vulnerability Analysis

The vulnerability resides in the Security component of Oracle Identity Manager. Oracle Identity Manager governs user provisioning, role assignment, and access certification across enterprise applications. An improper access control weakness allows an authenticated attacker with high privileges to bypass intended authorization boundaries. The flaw yields high impact on confidentiality and integrity, with no direct availability impact. The scope change indicates that exploitation crosses trust boundaries, extending compromise beyond the vulnerable component to other Oracle products that rely on identity assertions from Oracle Identity Manager. The EPSS score is 0.387% as of 2026-08-20.

Root Cause

The root cause is improper access control [CWE-284] within the Security component. Authorization checks fail to correctly enforce privilege boundaries on specific HTTP-accessible operations. A user who already possesses high privileges can invoke functionality or access data that should remain outside their authorization scope.

Attack Vector

Exploitation requires network access over HTTP and authenticated high-privileged credentials. No user interaction is needed. Once authenticated, the attacker submits requests that trigger the flawed authorization path and obtain unauthorized read, create, delete, or modify access to identity data. The scope change extends impact to federated or downstream Oracle products that trust the Identity Manager instance.

No public proof-of-concept code has been released. Oracle has not disclosed exploitation-technique details beyond the Oracle Security Alert August 2026.

Detection Methods for CVE-2026-60707

Indicators of Compromise

Unexpected creation, modification, or deletion of privileged accounts, roles, or entitlements inside Oracle Identity Manager.
Administrative HTTP requests originating from unusual source addresses or outside change-window hours.
Audit records showing privileged operations executed by accounts that do not typically perform identity administration.
Anomalous access to sensitive identity attributes or bulk data export events.

Detection Strategies

Review Oracle Identity Manager audit logs for privileged operations that fall outside documented change tickets.
Correlate authentication events with subsequent identity-modification actions to detect misuse of high-privileged credentials.
Monitor downstream Oracle applications for identity assertions or role changes that did not originate from an approved workflow.

Monitoring Recommendations

Forward Oracle Identity Manager audit and access logs to a centralized SIEM for retention and correlation.
Alert on administrative HTTP endpoints being accessed by service accounts or non-administrator identities.
Baseline normal privileged-user behavior and flag deviations in operation type, volume, or timing.

How to Mitigate CVE-2026-60707

Immediate Actions Required

Apply the fixes from the Oracle Security Alert August 2026 to affected Oracle Identity Manager deployments.
Inventory all Oracle Identity Manager instances running 12.2.1.4.0 or 14.1.2.1.0 and prioritize internet-reachable systems.
Rotate credentials for high-privileged Identity Manager accounts and review recent privileged activity for anomalies.

Patch Information

Oracle addressed CVE-2026-60707 in the August 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert August 2026 for the specific patch bundle applicable to versions 12.2.1.4.0 and 14.1.2.1.0, and apply it through standard Oracle Fusion Middleware patching procedures.

Workarounds

Restrict network access to Oracle Identity Manager administrative HTTP endpoints using firewalls or reverse-proxy allowlists.
Enforce multi-factor authentication for all high-privileged Identity Manager accounts to reduce the risk of credential misuse.
Reduce the number of accounts holding high administrative privileges and apply least-privilege role assignments until patching is complete.

bash

# Example: restrict access to Oracle Identity Manager admin endpoints at the network edge
iptables -A INPUT -p tcp --dport 14000 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 14000 -j DROP