CVE-2026-61066: Oracle Identity Manager RMI Vulnerability

CVE-2026-61066 Overview

CVE-2026-61066 is a critical vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware, affecting the OIM Legacy UI component. The affected versions are 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with network access via Remote Method Invocation (RMI) can compromise Oracle Identity Manager. The vulnerability carries scope change, meaning successful exploitation can significantly impact additional connected products beyond Oracle Identity Manager itself. Successful attacks result in full takeover of Oracle Identity Manager, with high impact to confidentiality, integrity, and availability.

Critical Impact
A low-privileged remote attacker can achieve complete takeover of Oracle Identity Manager over RMI, with scope change extending impact to additional downstream products.

Affected Products

Oracle Identity Manager 12.2.1.4.0
Oracle Identity Manager 14.1.2.1.0
Oracle Fusion Middleware (OIM Legacy UI component)

Discovery Timeline

2026-08-18 - CVE-2026-61066 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-61066

Vulnerability Analysis

The vulnerability resides in the OIM Legacy UI component of Oracle Identity Manager. Attackers reach the flaw over the network using Java Remote Method Invocation (RMI). Exploitation requires only low privileges and no user interaction. The vulnerability carries a scope change flag, meaning successful exploitation extends beyond the vulnerable component and impacts additional Oracle products that trust or integrate with Oracle Identity Manager. Because Oracle Identity Manager brokers user provisioning, entitlements, and identity workflows across enterprise systems, takeover results in cascading compromise of downstream applications and identity data.

Root Cause

Oracle has not published the specific weakness class for CVE-2026-61066, and the NVD entry is tagged NVD-CWE-noinfo. Based on the exposed RMI attack surface in the OIM Legacy UI and consistent with historical Oracle Identity Manager advisories, the fault pattern is characteristic of unsafe handling of remote-invocation input in a legacy Java interface. See the Oracle Security Alert for authoritative details.

Attack Vector

The attacker requires network reachability to the Oracle Identity Manager RMI listener and authenticated access with low privileges. From there, a crafted RMI request against the OIM Legacy UI component drives the compromise. No user interaction is required, and attack complexity is low. Because Oracle Identity Manager typically holds privileged connectors into Active Directory, HR systems, and downstream applications, a takeover produces immediate lateral impact.

No public proof-of-concept exploit is available at this time. Refer to the vendor advisory for technical details.

Detection Methods for CVE-2026-61066

Indicators of Compromise

Unexpected RMI connections to Oracle Identity Manager listener ports from internal hosts that do not normally interact with OIM.
New or modified administrative accounts, roles, or entitlements created through the OIM Legacy UI outside change-management windows.
Anomalous provisioning jobs pushing credentials or entitlements to downstream connected systems.
WebLogic or OIM server logs showing RMI invocations from low-privileged accounts followed by privilege changes.

Detection Strategies

Inspect Oracle Identity Manager audit logs for privilege escalations and configuration changes correlated with RMI session activity.
Alert on outbound activity from OIM hosts to connected identity stores that deviates from baseline provisioning schedules.
Correlate authentication events from low-privileged OIM accounts with subsequent administrative actions in the OIM Legacy UI.

Monitoring Recommendations

Enable verbose auditing on the OIM Legacy UI and the underlying WebLogic RMI transport.
Forward OIM, WebLogic, and connected-system logs to a centralized analytics platform for cross-source correlation.
Monitor for new service accounts or role grants issued by OIM in downstream applications such as Active Directory and databases.

How to Mitigate CVE-2026-61066

Immediate Actions Required

Apply the fixes from the Oracle Critical Patch Update advisory to all Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 instances.
Restrict network reachability to the OIM RMI listener to a small set of trusted administrative hosts.
Rotate credentials for all OIM administrative and connector accounts after patching.
Audit all recently created accounts, roles, and entitlements provisioned through OIM for unauthorized changes.

Patch Information

Oracle addressed CVE-2026-61066 in the August 2026 Critical Patch Update. Administrators should apply the vendor-supplied patches for Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 as documented in the Oracle Security Alert. Oracle recommends applying Critical Patch Update fixes without delay because customers are targeted after fixes are disclosed.

Workarounds

Place Oracle Identity Manager behind a segmented network zone that blocks RMI traffic from general user subnets.
Disable or restrict access to the OIM Legacy UI component if it is not required for business operations.
Enforce strong authentication and least-privilege role assignment for all OIM user accounts to reduce the pool of accounts that meet the low-privilege prerequisite.

bash

# Example: restrict RMI listener exposure at the host firewall
# Replace <admin_subnet> with your administrative management network
iptables -A INPUT -p tcp --dport 14000 -s <admin_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 14000 -j DROP