CVE-2026-60716: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-60716 Overview

CVE-2026-60716 affects the Oracle Identity Manager (OIM) product within Oracle Fusion Middleware. The flaw resides in the OIM Legacy UI component and impacts versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with network access via the T3 or IIOP protocols can compromise Oracle Identity Manager. Successful exploitation leads to full takeover of the identity management platform, breaking confidentiality, integrity, and availability.

The weakness is categorized under [CWE-306] Missing Authentication for Critical Function. Because Oracle Identity Manager brokers access to enterprise identities and downstream systems, takeover of this platform can cascade into broad enterprise identity compromise.

Critical Impact
An authenticated attacker with minimal privileges can achieve complete takeover of Oracle Identity Manager over the network, gaining control of provisioned identities and access policies.

Affected Products

Oracle Identity Manager 12.2.1.4.0
Oracle Identity Manager 14.1.2.1.0
Oracle Fusion Middleware deployments exposing OIM Legacy UI over T3 or IIOP

Discovery Timeline

2026-08-18 - CVE-2026-60716 published to the National Vulnerability Database
2026-08-18 - Oracle publishes advisory in the Oracle Security Alert
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60716

Vulnerability Analysis

Oracle Identity Manager exposes remote interfaces through the Oracle WebLogic Server protocols T3 and Internet Inter-ORB Protocol (IIOP). These protocols are used for Remote Method Invocation (RMI) style calls into managed beans and legacy servlets. The OIM Legacy UI component fails to enforce sufficient authentication for a critical function reachable through these channels.

A low-privileged attacker with any valid session or account context on the network path can invoke sensitive operations reserved for administrators. Because Oracle Identity Manager centrally provisions accounts, roles, and entitlements across connected systems, control of OIM translates directly to control of downstream applications, directories, and cloud services.

The attack is described by Oracle as easily exploitable and requires no user interaction. The Confidentiality, Integrity, and Availability impacts are all rated High, reflecting full platform takeover.

Root Cause

The root cause is a missing authentication check on a critical function within the OIM Legacy UI ([CWE-306]). Remote entry points accessible over T3 and IIOP do not adequately validate the caller's privilege level before executing privileged operations. Legacy UI code paths inherit trust assumptions from earlier deployment models that were not designed for exposure to low-privileged network users.

Attack Vector

An attacker requires network reachability to the WebLogic listen ports serving T3 or IIOP on the Oracle Identity Manager managed server. Using a standard WebLogic client, the attacker authenticates with low-privileged credentials and invokes the vulnerable Legacy UI operation. The operation executes with elevated context, allowing the attacker to modify identity records, escalate privileges, or seize administrative control of OIM.

No verified public exploit code is available at the time of publication. Refer to the Oracle Security Alert for authoritative technical guidance.

Detection Methods for CVE-2026-60716

Indicators of Compromise

Unexpected T3 or IIOP client connections to WebLogic managed servers hosting Oracle Identity Manager from non-administrative subnets.
New or modified administrative role assignments in OIM audit tables that do not correspond to a change ticket.
Sudden creation of privileged accounts or provisioning tasks originating from low-privileged user sessions.
WebLogic server log entries showing RMI invocations against Legacy UI managed beans by non-admin principals.

Detection Strategies

Enable and forward WebLogic access logs, OIM audit logs, and JVM security manager logs to a central analytics platform for correlation.
Baseline expected T3 and IIOP client sources, then alert on any deviation from that baseline reaching OIM ports.
Correlate OIM role and entitlement changes against authorized change management records to surface unauthorized modifications.

Monitoring Recommendations

Monitor for authentication events from low-privileged OIM users followed by administrative provisioning actions within a short time window.
Track process and network telemetry on OIM hosts for outbound connections to attacker infrastructure following suspicious RMI activity.
Alert on modifications to oim-config.xml, connector configurations, and scheduled task definitions on OIM managed servers.

How to Mitigate CVE-2026-60716

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert to all Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 deployments.
Restrict network access to WebLogic T3 and IIOP listen ports to trusted administrative networks only.
Audit existing OIM accounts and roles for unauthorized changes performed prior to patching.
Rotate credentials for OIM administrative accounts and any service accounts brokered by OIM.

Patch Information

Oracle addressed CVE-2026-60716 in the August 2026 Critical Patch Update. Administrators must download and apply the OIM patches specific to versions 12.2.1.4.0 and 14.1.2.1.0 as directed by the Oracle Security Alert. Verify patch application by checking the OIM inventory and confirming the reported build numbers match the fixed release.

Workarounds

Use the WebLogic connection filter (weblogic.security.net.ConnectionFilterImpl) to block T3 and IIOP traffic from untrusted sources until patching is complete.
Disable IIOP on OIM managed servers if not required by dependent applications.
Place OIM administrative interfaces behind a reverse proxy or bastion that enforces strong network-layer authentication.
Enforce multi-factor authentication for all OIM user accounts to reduce the value of any low-privileged credential an attacker may already hold.

bash

# Example WebLogic connection filter configuration to restrict T3/IIOP
# Configure in the WebLogic Admin Console: Security > Filter
# Connection Filter: weblogic.security.net.ConnectionFilterImpl
# Connection Filter Rules (allow only admin subnet, deny others):
10.10.10.0/24 * * allow t3 t3s iiop iiops
0.0.0.0/0    * * deny  t3 t3s iiop iiops