CVE-2026-60715: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-60715 Overview

CVE-2026-60715 is a high-severity vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware. The flaw resides in the OIM Legacy UI component and affects supported versions 12.2.1.4.0 and 14.1.2.1.0. An attacker with low privileges and network access via HTTP can compromise Oracle Identity Manager. Successful exploitation results in complete takeover of the Identity Manager instance, impacting confidentiality, integrity, and availability. The vulnerability is classified under CWE-284: Improper Access Control.

Critical Impact
A low-privileged attacker can take over Oracle Identity Manager over the network via HTTP, gaining full control of identity, access, and provisioning functions across the enterprise.

Affected Products

Oracle Identity Manager 12.2.1.4.0
Oracle Identity Manager 14.1.2.1.0
Oracle Fusion Middleware — OIM Legacy UI component

Discovery Timeline

2026-08-18 - CVE-2026-60715 published to the National Vulnerability Database
2026-08-18 - Oracle publishes Security Alert CSPUAUG2026
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60715

Vulnerability Analysis

Oracle Identity Manager (OIM) is the identity governance and provisioning engine within Oracle Fusion Middleware. It manages user lifecycles, roles, entitlements, and access requests across connected enterprise systems. The vulnerability affects the OIM Legacy UI, a web-facing component used to administer identities and access.

The flaw allows an authenticated attacker holding only low-privileged credentials to escalate control over the entire Identity Manager instance. Because OIM sits at the center of enterprise identity operations, a takeover cascades into every downstream system it provisions.

The attack requires no user interaction, has low attack complexity, and can be executed over the network via HTTP. This combination makes the vulnerability suitable for opportunistic exploitation once initial low-privilege access is obtained.

Root Cause

The root cause maps to CWE-284: Improper Access Control. The OIM Legacy UI does not sufficiently restrict access to sensitive functionality based on the caller's privilege level. Oracle has not published detailed technical internals; the Oracle Security Alert CSPUAUG2026 is the authoritative source.

Attack Vector

An attacker authenticates to the OIM Legacy UI using low-privileged credentials such as those of a standard end user or self-service account. The attacker then sends crafted HTTP requests to functionality that should be restricted to administrators. Because access checks are missing or incomplete, the requests succeed and grant the attacker elevated control over Identity Manager, including its stored credentials, provisioning workflows, and downstream connectors.

Oracle has not disclosed a proof of concept, and no public exploit is currently available. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Oracle Security Alert CSPUAUG2026 for vendor guidance.

Detection Methods for CVE-2026-60715

Indicators of Compromise

Unexpected role, group, or entitlement modifications originating from low-privileged OIM accounts.
HTTP requests to OIM Legacy UI administrative endpoints from user sessions that should not have admin scope.
New administrative accounts, connector configuration changes, or provisioning policy edits without a corresponding change ticket.
Unusual bulk provisioning or deprovisioning activity from a single session.

Detection Strategies

Enable full audit logging within Oracle Identity Manager and forward events to a centralized SIEM for correlation.
Baseline normal Legacy UI URL patterns per user role, then alert on standard users invoking administrative paths.
Correlate OIM authentication events with subsequent role or policy changes to identify privilege mismatches.
Review WebLogic access logs fronting OIM for anomalous POST volumes and non-standard user agents.

Monitoring Recommendations

Monitor changes to xelsysadm and other administrative accounts, including password resets and role grants.
Alert on modifications to OIM adapters, event handlers, and scheduled tasks, which are common persistence targets.
Track outbound provisioning activity to downstream targets such as Active Directory, LDAP, and SaaS connectors for unauthorized account creation.

How to Mitigate CVE-2026-60715

Immediate Actions Required

Apply the fixes documented in the Oracle Security Alert CSPUAUG2026 to affected Oracle Identity Manager deployments.
Restrict network access to the OIM Legacy UI to trusted administrative networks or VPN segments until patching completes.
Rotate credentials for xelsysadm and any administrative or service accounts within OIM after patching.
Review OIM audit logs for signs of prior exploitation, focusing on the disclosure window and earlier.

Patch Information

Oracle addressed CVE-2026-60715 in the Oracle Security Alert CSPUAUG2026 published on 2026-08-18. Customers running Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 must apply the patches referenced in that alert. Oracle strongly recommends applying security fixes without delay, as public disclosure typically increases exploitation attempts. Refer to the vendor advisory for exact patch identifiers and prerequisites.

Workarounds

Disable or block access to the OIM Legacy UI at the reverse proxy or load balancer if the modern UI meets operational needs.
Enforce strict network segmentation so that only jump hosts or administrative subnets can reach OIM management URLs.
Tighten OIM role assignments and remove unnecessary standing privileges from self-service accounts to reduce the pool of usable low-privileged credentials.

bash

# Example: restrict OIM Legacy UI paths at an NGINX reverse proxy
# Replace <ADMIN_CIDR> with your administrative network range
location /oim/faces/ {
    allow <ADMIN_CIDR>;
    deny all;
    proxy_pass http://oim_backend;
}