CVE-2026-61118: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-61118 Overview

CVE-2026-61118 is a high-severity vulnerability in the Oracle Identity Manager (OIM) product within Oracle Fusion Middleware. The flaw resides in the OIM Legacy UI component and affects supported versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with network access over HTTP can exploit this issue to compromise the identity platform. Successful exploitation results in full takeover of Oracle Identity Manager, impacting confidentiality, integrity, and availability. Because Oracle Identity Manager governs user provisioning and access across enterprise applications, a takeover directly threatens the integrity of downstream identity trust.

Critical Impact
Successful attacks can result in complete takeover of Oracle Identity Manager, granting adversaries control over identity provisioning, authentication workflows, and downstream application access.

Affected Products

Oracle Identity Manager 12.2.1.4.0
Oracle Identity Manager 14.1.2.1.0
Oracle Fusion Middleware (OIM Legacy UI component)

Discovery Timeline

2026-08-18 - CVE-2026-61118 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-61118

Vulnerability Analysis

The vulnerability exists in the OIM Legacy UI component of Oracle Identity Manager. An authenticated attacker holding a low-privileged account can send crafted HTTP requests to the Legacy UI to gain full control of the Identity Manager instance. Oracle classifies the flaw as easily exploitable, indicating a straightforward attack path with high reliability. The impact set of confidentiality, integrity, and availability means an attacker can read sensitive identity data, modify user records and entitlements, and disrupt service.

Because Oracle Identity Manager is an identity governance platform, a takeover extends beyond the OIM instance itself. An adversary who controls OIM can create privileged accounts, alter role assignments, and pivot into any application that trusts OIM for provisioning or authentication.

Root Cause

Oracle has not published detailed root-cause information, and the CWE is recorded as NVD-CWE-noinfo. The advisory attributes the flaw to the OIM Legacy UI component. Given the takeover impact combined with a low-privilege prerequisite and no user interaction, the underlying weakness aligns with an authorization or access-control failure in the Legacy UI request handling path.

Attack Vector

The attack is remote and network-based over HTTP. An attacker requires only a low-privileged account within OIM and no user interaction from a victim. The attacker sends crafted requests to the Legacy UI endpoints exposed by the Identity Manager server. Because the Legacy UI ships enabled in the affected releases, any exposed OIM administrative surface is reachable if network segmentation does not restrict it.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Oracle Security Alert for authoritative technical guidance.

Detection Methods for CVE-2026-61118

Indicators of Compromise

Unexpected creation of privileged OIM roles, administrators, or service accounts through the Legacy UI.
HTTP requests to OIM Legacy UI endpoints from low-privileged user sessions performing administrative operations.
Modifications to entitlement, role, or workflow objects that do not correspond to an approved change ticket.
Anomalous downstream provisioning events across connected target systems originating from OIM.

Detection Strategies

Review OIM audit logs for privilege escalation events tied to accounts that historically held only end-user permissions.
Correlate Legacy UI HTTP access logs with authenticated session identifiers to spot low-privileged sessions accessing administrative paths.
Baseline normal provisioning volumes and alert on sudden spikes in role grants or account creations.
Ingest OIM and WebLogic access logs into a centralized analytics platform for cross-source correlation with endpoint and identity telemetry.

Monitoring Recommendations

Forward OIM audit, WebLogic access, and Fusion Middleware diagnostic logs to a SIEM for retention and analysis.
Monitor authentication and authorization changes in target systems provisioned by OIM for signs of lateral abuse.
Alert on any successful HTTP requests to Legacy UI administrative paths from accounts flagged as low-privilege.

How to Mitigate CVE-2026-61118

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the August 2026 Oracle Security Alert to affected OIM deployments.
Restrict network access to OIM administrative interfaces to trusted management networks and jump hosts.
Audit all OIM user accounts and remove or disable low-privileged accounts that are no longer required.
Rotate credentials and review privileged role membership after patching to validate no unauthorized changes persist.

Patch Information

Oracle addressed CVE-2026-61118 in the August 2026 Critical Patch Update. Administrators running Oracle Identity Manager 12.2.1.4.0 or 14.1.2.1.0 should apply the patches referenced in the Oracle Security Alert. Validate patch application in a staging environment, confirm OIM services start cleanly, and verify the Legacy UI version after deployment.

Workarounds

Disable or block network access to the OIM Legacy UI component if it is not required for operations.
Enforce strict web application firewall rules that constrain requests to Legacy UI paths to authorized administrator source addresses.
Reduce standing privileges by moving OIM operators to just-in-time access models until the patch is applied.

bash

# Example: restrict Legacy UI access at a reverse proxy (illustrative)
# Replace the allow list and path with values that match your deployment
location /oim/faces/pages/Admin.jspx {
    allow 10.10.20.0/24;   # admin jump network
    deny  all;
    proxy_pass http://oim-backend;
}