CVE-2026-60720: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-60720 Overview

CVE-2026-60720 is a critical vulnerability in the Oracle Identity Manager (OIM) product of Oracle Fusion Middleware, specifically within the OIM Legacy UI component. The flaw affects Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with network access via HTTP can exploit this vulnerability to compromise Oracle Identity Manager. The vulnerability carries a scope change, meaning successful exploitation impacts resources beyond the vulnerable component itself. Successful attacks result in full takeover of Oracle Identity Manager, including confidentiality, integrity, and availability compromise across connected systems.

Critical Impact
A low-privileged, network-adjacent attacker can achieve full takeover of Oracle Identity Manager, with cascading impact to additional Oracle Fusion Middleware products due to scope change.

Affected Products

Oracle Identity Manager 12.2.1.4.0
Oracle Identity Manager 14.1.2.1.0
Oracle Fusion Middleware (OIM Legacy UI component)

Discovery Timeline

2026-08-18 - CVE-2026-60720 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60720

Vulnerability Analysis

CVE-2026-60720 resides in the OIM Legacy UI component of Oracle Identity Manager, an enterprise identity governance platform used to manage user provisioning, access certification, and role lifecycle management. The vulnerability allows an authenticated attacker with minimal privileges to compromise the entire Oracle Identity Manager deployment through HTTP-based requests.

Because Oracle Identity Manager brokers identity and access decisions for downstream applications, a compromise propagates outward. The scope change indicates that the attacker can affect resources controlled by a different security authority than the vulnerable component. This makes the vulnerability suitable for lateral movement across the Fusion Middleware estate.

The advisory does not disclose the specific weakness class ([NVD-CWE-noinfo]), but the combination of low attack complexity, network reachability, and low-privilege prerequisite indicates a flaw exploitable through standard authenticated HTTP interactions with the legacy UI.

Root Cause

Oracle has not publicly disclosed the underlying defect. The affected surface is the OIM Legacy UI, a browser-facing component that processes authenticated user requests. Root-cause analysis requires review of Oracle's Critical Patch Update advisory referenced below.

Attack Vector

The attack originates over the network via HTTP against an exposed Oracle Identity Manager instance. The attacker must hold a valid low-privileged account. No user interaction is required. After authentication, the attacker sends crafted requests to the legacy UI endpoints, achieving takeover of the OIM instance and pivoting into connected systems governed by Oracle Identity Manager.

No public proof-of-concept exploit is available at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.447%.

Detection Methods for CVE-2026-60720

Indicators of Compromise

Anomalous authenticated HTTP requests to Oracle Identity Manager Legacy UI endpoints, especially from accounts with minimal historical activity.
Unexpected creation, elevation, or modification of privileged OIM accounts and roles.
Outbound connections or provisioning events initiated from the OIM host to systems it does not normally reach.
Unusual access to Oracle Fusion Middleware components downstream of OIM following a spike in Legacy UI traffic.

Detection Strategies

Correlate OIM application logs, WebLogic access logs, and identity provisioning events to detect low-privileged accounts performing administrative actions.
Monitor authentication and authorization changes within OIM against a baseline of expected role assignments and delegated administration.
Alert on Legacy UI request patterns that deviate from normal user workflows, such as direct requests to internal servlet paths.

Monitoring Recommendations

Forward OIM, WebLogic, and database audit logs to a centralized SIEM for cross-source correlation.
Enable Oracle Identity Manager audit policies at the highest verbosity supported by production performance budgets.
Track privileged account creation and role membership changes as high-severity events pending patch deployment.

How to Mitigate CVE-2026-60720

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert to all affected OIM 12.2.1.4.0 and 14.1.2.1.0 deployments.
Inventory all Oracle Identity Manager instances, including non-production, and confirm patch status for each.
Rotate credentials for OIM administrative and service accounts after patching, and review recent role and entitlement changes for signs of abuse.
Restrict network access to OIM Legacy UI endpoints to trusted management networks until patching is complete.

Patch Information

Oracle addressed CVE-2026-60720 in its August 2026 Critical Patch Update. Refer to the Oracle Security Alert for the specific patch bundle, prerequisite versions, and installation guidance for Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0.

Workarounds

Where patching cannot be scheduled immediately, place the OIM Legacy UI behind a reverse proxy or WAF that enforces strict authentication and rate-limiting on legacy endpoints.
Disable or restrict access to the Legacy UI component if the deployment does not require it for operational workflows.
Enforce network segmentation so that only jump hosts or administrative networks can reach OIM management interfaces.

bash

# Example: restrict OIM Legacy UI access at the reverse proxy (illustrative)
# Replace paths and CIDRs to match your deployment
location /identity/faces/ {
    allow 10.10.20.0/24;   # trusted admin subnet
    deny  all;
    proxy_pass https://oim-backend.internal;
}