CVE-2026-60727: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-60727 Overview

CVE-2026-60727 is a critical unauthenticated remote takeover vulnerability in the OIM Legacy UI component of Oracle Identity Manager, part of Oracle Fusion Middleware. Affected versions include 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via HTTP can exploit this flaw to fully compromise Oracle Identity Manager. Successful exploitation results in complete takeover of the identity management platform, impacting the confidentiality, integrity, and availability of all managed identities and provisioning workflows. Oracle disclosed the issue in its August 2026 Critical Patch Update.

Critical Impact
Unauthenticated network attackers can achieve full takeover of Oracle Identity Manager, gaining control over enterprise identity provisioning, credential stores, and downstream connected systems.

Affected Products

Oracle Identity Manager 12.2.1.4.0
Oracle Identity Manager 14.1.2.1.0
Oracle Fusion Middleware deployments exposing the OIM Legacy UI component

Discovery Timeline

2026-08-18 - CVE-2026-60727 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-60727

Vulnerability Analysis

The vulnerability resides in the OIM Legacy UI component of Oracle Identity Manager. Oracle Identity Manager is an enterprise identity governance platform that provisions, manages, and audits user accounts across connected systems. The flaw is categorized under [CWE-284] Improper Access Control, indicating that the affected component fails to correctly enforce authentication or authorization before granting privileged operations.

An attacker reaches the vulnerable interface over HTTP without prior credentials or user interaction. Once exploited, the attacker gains control over the Identity Manager instance and its administrative capabilities. Because Oracle Identity Manager holds trust relationships with directories, databases, and business applications, takeover of this platform provides a pivot point into every downstream integrated system.

Root Cause

The root cause is improper access control within the OIM Legacy UI. Requests that should require authenticated administrative sessions are processed without proper enforcement of identity or privilege checks. This class of defect commonly results from legacy request handlers that bypass modern authentication filters, inconsistent URL protection rules, or missing authorization decisions in servlet paths inherited from earlier product versions.

Attack Vector

Exploitation occurs remotely over the network using standard HTTP requests to the Identity Manager web tier. No authentication is required and no user interaction is needed. An attacker who can reach the OIM Legacy UI endpoint, whether directly or through a reverse proxy, can invoke the vulnerable functionality and take control of the application. Detailed exploitation mechanics are described in the Oracle Security Alert.

Detection Methods for CVE-2026-60727

Indicators of Compromise

Unexpected HTTP requests to OIM Legacy UI paths originating from external or non-administrative source addresses
Creation of new administrative accounts, roles, or provisioning policies in Oracle Identity Manager audit logs without corresponding change tickets
Anomalous outbound connections from the Identity Manager application server to unfamiliar hosts
New or modified scheduled tasks and adapters within Oracle Identity Manager

Detection Strategies

Monitor Oracle Identity Manager access logs for unauthenticated requests reaching Legacy UI endpoints that should require an active administrative session
Alert on privilege changes, role assignments, and connector reconfigurations that occur outside approved change windows
Correlate WebLogic server logs with identity provisioning events to identify sessions that lack a valid authentication chain

Monitoring Recommendations

Forward Oracle Identity Manager and WebLogic access, audit, and application logs to a centralized analytics platform for retention and correlation
Baseline normal administrative activity per user and per source network, then alert on deviations
Track EPSS trend data for CVE-2026-60727 (current EPSS 0.45%) to prioritize response as exploitation likelihood shifts

How to Mitigate CVE-2026-60727

Immediate Actions Required

Apply the fixes from the Oracle August 2026 Critical Patch Update to all Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 deployments
Restrict network exposure of the OIM Legacy UI to trusted administrative networks and jump hosts only
Review Oracle Identity Manager audit and provisioning logs for anomalous activity since the disclosure date
Rotate credentials, API keys, and service account passwords managed through the affected Identity Manager instance if compromise is suspected

Patch Information

Oracle addressed CVE-2026-60727 in the August 2026 Critical Patch Update. Refer to the Oracle Security Alert for the specific patch bundles applicable to Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0. Apply patches in a staged manner following Oracle Fusion Middleware upgrade guidance.

Workarounds

Block external access to OIM Legacy UI URL patterns at the reverse proxy, load balancer, or web application firewall until patches are applied
Enforce IP allowlisting on the Identity Manager management interfaces so only administrative subnets can reach the affected component
Disable or unmap the OIM Legacy UI context if it is not required for business operations, following Oracle's supported configuration guidance

bash

# Example: restrict OIM Legacy UI access at an Apache reverse proxy
<Location /oim>
    Require ip 10.0.0.0/8
    Require ip 192.168.10.0/24
</Location>