CVE-2026-60721: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-60721 Overview

CVE-2026-60721 is a critical authentication vulnerability in Oracle Identity Manager, a component of Oracle Fusion Middleware. The flaw resides in the OIM Legacy UI component and affects supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Identity Manager without any user interaction. Successful exploitation results in complete takeover of the identity management platform. Oracle disclosed the issue in its August 2026 Critical Patch Update advisory. The vulnerability is classified under [CWE-306] Missing Authentication for Critical Function.

Critical Impact
Unauthenticated remote attackers can take over Oracle Identity Manager over the network, compromising the confidentiality, integrity, and availability of the enterprise identity infrastructure.

Affected Products

Oracle Identity Manager 12.2.1.4.0
Oracle Identity Manager 14.1.2.1.0
Oracle Fusion Middleware deployments using the OIM Legacy UI component

Discovery Timeline

2026-08-18 - CVE-2026-60721 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60721

Vulnerability Analysis

Oracle Identity Manager (OIM) provisions, manages, and audits user identities across enterprise applications. The vulnerability affects the OIM Legacy UI component, which is reachable over HTTP. Attackers can exploit the flaw remotely without credentials and without user interaction. Oracle categorizes the outcome as full product takeover, impacting confidentiality, integrity, and availability.

Because OIM sits at the center of enterprise identity workflows, compromise extends beyond the application itself. An attacker in control of OIM can provision privileged accounts, reset credentials, and manipulate role assignments across downstream systems. This provides a direct path to lateral movement across any application integrated with OIM.

Root Cause

The CWE-306 classification indicates missing authentication for a critical function exposed by the OIM Legacy UI. A code path that should require authenticated access is reachable by anonymous HTTP clients. Oracle has not disclosed further internal details in the public advisory.

Attack Vector

The attack vector is network-based over HTTP. An attacker sends crafted HTTP requests to the OIM Legacy UI endpoint on an exposed OIM server. No credentials, tokens, or user interaction are required. Internet-facing OIM deployments are at the highest risk, but attackers with a foothold on internal networks can also reach the vulnerable endpoint.

No public proof-of-concept exploit code is currently available. The EPSS probability is 0.486%. Refer to the Oracle Security Alert for the authoritative advisory.

Detection Methods for CVE-2026-60721

Indicators of Compromise

Unexpected administrative or privileged account creation within Oracle Identity Manager
Unauthenticated HTTP requests to OIM Legacy UI paths originating from unusual source addresses
Anomalous role assignments, credential resets, or provisioning workflows initiated without a corresponding admin session
New or modified OIM scheduled tasks and connectors that do not map to change tickets

Detection Strategies

Inspect OIM access logs and reverse proxy logs for anonymous requests to Legacy UI endpoints returning HTTP 200 responses
Correlate OIM audit events with authentication logs to identify privileged actions that lack a preceding successful login
Alert on outbound connections from OIM application servers to untrusted destinations, which may indicate post-exploit command-and-control

Monitoring Recommendations

Forward OIM application, WebLogic, and web tier logs to a centralized SIEM with retention aligned to incident response requirements
Monitor for changes to OIM policy objects, adapters, and event handlers using file integrity monitoring
Baseline normal admin activity patterns and alert on deviations such as off-hours provisioning bursts

How to Mitigate CVE-2026-60721

Immediate Actions Required

Apply the August 2026 Oracle Critical Patch Update to all affected OIM instances as the primary remediation
Restrict network access to the OIM Legacy UI so it is not reachable from the internet or untrusted network segments
Review OIM audit logs for suspicious provisioning activity since the vulnerability was disclosed
Rotate credentials for OIM administrative accounts and integrated service accounts following patching

Patch Information

Oracle addressed CVE-2026-60721 in the August 2026 Critical Patch Update. Administrators must apply the fixes documented in the Oracle Security Alert for Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0. Patching is the only vendor-supported remediation.

Workarounds

Place OIM behind a reverse proxy or web application firewall that enforces authentication before requests reach the Legacy UI
Block external access to OIM Legacy UI URI paths at the network edge until patches are deployed
Disable the OIM Legacy UI component if it is not required by business workflows, following Oracle guidance

bash

# Example: block external access to OIM Legacy UI at an NGINX reverse proxy
location /identity/faces/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://oim-backend;
}