CVE-2026-60722: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-60722 Overview

CVE-2026-60722 is a high-severity vulnerability in the Oracle Identity Manager (OIM) product of Oracle Fusion Middleware. The flaw resides in the OIM Legacy UI component and affects versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with network access via the T3 or IIOP protocols can exploit this weakness to fully compromise the identity management platform. Successful exploitation results in complete takeover of Oracle Identity Manager, impacting confidentiality, integrity, and availability. The vulnerability is associated with CWE-306: Missing Authentication for Critical Function.

Critical Impact
Attackers with valid low-privileged credentials can achieve full takeover of Oracle Identity Manager through T3 or IIOP network access, compromising the identity backbone of the enterprise.

Affected Products

Oracle Identity Manager 12.2.1.4.0
Oracle Identity Manager 14.1.2.1.0
Oracle Fusion Middleware (OIM Legacy UI component)

Discovery Timeline

2026-08-18 - CVE-2026-60722 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60722

Vulnerability Analysis

The vulnerability affects the Legacy UI component of Oracle Identity Manager, which is exposed through Oracle WebLogic Server's T3 and Internet Inter-ORB Protocol (IIOP) listeners. These protocols are used for Remote Method Invocation (RMI) communication between Java clients and the WebLogic application server. When an authenticated but low-privileged user establishes a T3 or IIOP session, the OIM Legacy UI fails to enforce authentication for a critical function, mapped to CWE-306.

Successful exploitation grants the attacker full control over Oracle Identity Manager. Because OIM governs user provisioning, role assignments, and access certification across enterprise applications, takeover of this component provides a pivot into every downstream system it manages.

Root Cause

The root cause is missing authentication for a critical function exposed via the OIM Legacy UI over T3 and IIOP. The Legacy UI stack accepts remote invocations that should be restricted to administrative principals but does not adequately validate the caller's privileges before executing sensitive operations.

Attack Vector

Exploitation requires network reachability to the WebLogic T3 or IIOP listener and a valid low-privileged account. No user interaction is required, and attack complexity is low. Given that T3 and IIOP are historically abused for Java deserialization and privileged RMI abuse, this vector is well-understood by attackers targeting Fusion Middleware. Refer to the Oracle Security Alert for vendor-supplied technical detail.

No public proof-of-concept is available at the time of publication, and the EPSS score reflects a low current probability of observed exploitation. This posture can change quickly once patches are diffed.

Detection Methods for CVE-2026-60722

Indicators of Compromise

Unexpected T3 or IIOP connections to WebLogic ports (default 7001/7002) originating from non-administrative subnets or user endpoints.
New or modified administrative accounts, roles, or entitlements in Oracle Identity Manager created by low-privileged principals.
Anomalous outbound connections from the WebLogic managed server hosting OIM, suggesting post-exploitation command-and-control.
Java process spawning shell interpreters or scripting engines under the WebLogic runtime user.

Detection Strategies

Inspect WebLogic access logs and OIM audit tables for privileged operations executed by accounts that lack the corresponding roles.
Alert on RMI or T3 traffic from workstations, VDI ranges, or DMZ hosts that should never speak these protocols to OIM.
Correlate OIM administrative changes with the identity of the requesting session and its assigned role tier.

Monitoring Recommendations

Enable WebLogic audit logging at the highest verbosity for T3 and IIOP endpoints and forward logs to a centralized analytics platform.
Baseline expected callers of the OIM Legacy UI and alert on deviation.
Monitor child processes of the WebLogic JVM for signs of code execution originating from deserialization or RMI abuse.

How to Mitigate CVE-2026-60722

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert to Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0.
Restrict network access to WebLogic T3 and IIOP listeners to a defined administrative management network.
Rotate credentials for any low-privileged OIM accounts that could be leveraged as an exploitation prerequisite.
Review OIM audit history for unauthorized administrative changes since the affected versions were deployed.

Patch Information

Oracle addressed CVE-2026-60722 in the August 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert for the specific patch bundle applicable to their OIM version and apply it in accordance with Oracle's documented upgrade procedures.

Workarounds

Deploy the WebLogic Connection Filter (weblogic.security.net.ConnectionFilterImpl) to block T3 and IIOP from untrusted sources until patching is complete.
Disable IIOP on managed servers that do not require it through the WebLogic Administration Console.
Place OIM behind a reverse proxy or jump host that terminates only HTTPS traffic and blocks RMI-based protocols at the perimeter.
Enforce least privilege on OIM accounts and remove dormant low-privileged users that could be repurposed by an attacker.

bash

# Example WebLogic connection filter rules to restrict T3/IIOP
# Configured in Admin Console: Domain > Security > Filter
# Format: target localAddress localPort action protocols

10.10.20.0/24  *  7001  allow  t3 t3s iiop iiops
0.0.0.0/0      *  7001  deny   t3 t3s iiop iiops