CVE-2026-61196: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-61196 Overview

CVE-2026-61196 is a critical authentication bypass vulnerability in the Oracle Identity Manager (OIM) product of Oracle Fusion Middleware. The flaw resides in the OIM Legacy UI component and affects supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via HTTP can exploit the vulnerability to fully compromise Oracle Identity Manager. Successful exploitation results in complete takeover of the identity management platform, exposing every downstream account, entitlement, and provisioning workflow it governs. The weakness is classified as Missing Authentication for Critical Function [CWE-306].

Critical Impact
Unauthenticated remote attackers can take over Oracle Identity Manager, gaining control of the identity backbone used to provision and govern access across enterprise systems.

Affected Products

Oracle Identity Manager 12.2.1.4.0
Oracle Identity Manager 14.1.2.1.0
Oracle Fusion Middleware - OIM Legacy UI component

Discovery Timeline

2026-07-21 - CVE-2026-61196 published to NVD
2026-07-22 - Last updated in NVD database
July 2026 - Addressed in the Oracle Security Alert July 2026

Technical Details for CVE-2026-61196

Vulnerability Analysis

The vulnerability allows unauthenticated attackers to interact with functionality in the OIM Legacy UI that should require authenticated sessions. Because Oracle Identity Manager brokers provisioning, role assignment, and password management across connected systems, a takeover of OIM grants an attacker the ability to create privileged accounts, reset credentials, and pivot into downstream applications. The attack requires only network reachability to the HTTP interface, with no user interaction and no prior credentials. Exploitation impacts confidentiality, integrity, and availability of the identity platform.

Root Cause

The issue maps to [CWE-306] Missing Authentication for Critical Function. One or more endpoints exposed by the OIM Legacy UI component do not enforce authentication before granting access to privileged operations. As a result, the trust boundary that should separate anonymous HTTP clients from administrative identity workflows is absent, and requests reach sensitive handlers without an authenticated principal.

Attack Vector

The attack vector is network-based over HTTP against an exposed Oracle Identity Manager deployment. An attacker sends crafted HTTP requests directly to affected OIM Legacy UI endpoints without supplying credentials. Because Identity Manager instances are frequently reachable from internal networks and, in some deployments, from partner or internet-facing zones, the exposure profile is broad. Successful requests yield administrative-level control over the identity platform. Oracle has not published exploitation details, and no public proof-of-concept is currently listed. Refer to the Oracle Security Alert July 2026 for vendor guidance.

Detection Methods for CVE-2026-61196

Indicators of Compromise

Unauthenticated HTTP requests to Oracle Identity Manager Legacy UI paths returning 200 OK without a valid session cookie or Authorization header.
Unexpected creation, modification, or role assignment of OIM user accounts, especially privileged administrators, outside of change windows.
New provisioning tasks or password resets originating from unknown source IPs in OIM audit logs.
Outbound connections from the OIM application server to unfamiliar hosts following anomalous HTTP traffic to the Legacy UI.

Detection Strategies

Inspect web server and reverse proxy access logs for requests to OIM Legacy UI endpoints that lack authentication headers yet receive successful responses.
Correlate OIM audit events with authentication logs to surface administrative actions that have no preceding successful login.
Alert on bursts of HTTP requests to Identity Manager from a single external or unusual internal source.

Monitoring Recommendations

Forward WebLogic, OIM audit, and web tier logs into a centralized analytics platform and retain them for extended investigation windows.
Monitor for changes to privileged OIM roles, catalog entries, and connector configurations in near real time.
Track baseline request patterns to the OIM Legacy UI so deviations trigger investigation.

How to Mitigate CVE-2026-61196

Immediate Actions Required

Apply the July 2026 Oracle Critical Patch Update to every Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 instance.
Restrict network access to the OIM Legacy UI to trusted management networks using firewall rules or reverse proxy allow-lists.
Review OIM audit logs for signs of unauthenticated administrative activity dating back to before patch deployment.
Rotate credentials and API keys for accounts provisioned or modified through OIM if compromise is suspected.

Patch Information

Oracle addressed CVE-2026-61196 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert July 2026 for the specific patch identifiers matching their OIM version and apply them following Oracle's documented upgrade procedures. No supported workaround replaces patching for this vulnerability.

Workarounds

Block external and untrusted internal access to Oracle Identity Manager HTTP endpoints at the network perimeter until patches are applied.
Disable or firewall the OIM Legacy UI paths where operationally feasible, deferring users to the modern Identity Self Service and Identity System Administration consoles.
Enforce web application firewall rules that require authenticated session cookies before requests reach OIM Legacy UI handlers.

bash

# Example: restrict Oracle Identity Manager Legacy UI access at the reverse proxy
# (Apache httpd configuration snippet)
<Location "/oim">
    Require ip 10.0.0.0/8 192.168.0.0/16
    # Deny everything else until the July 2026 CPU is applied
</Location>