CVE-2026-61197: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-61197 Overview

CVE-2026-61197 is a critical access control flaw in the Oracle Identity Manager (OIM) product of Oracle Fusion Middleware, specifically within the OIM Legacy UI component. The vulnerability allows an unauthenticated remote attacker with HTTP network access to compromise the identity management platform. Successful exploitation results in unauthorized creation, deletion, or modification of critical data, along with unauthorized read access to all data accessible through Oracle Identity Manager. Affected versions include 12.2.1.4.0 and 14.1.2.1.0. The weakness is categorized under [CWE-284] Improper Access Control.

Critical Impact
Unauthenticated network attackers can gain full read and write access to all data managed by Oracle Identity Manager, undermining the integrity of enterprise identity governance.

Affected Products

Oracle Fusion Middleware — Oracle Identity Manager 12.2.1.4.0
Oracle Fusion Middleware — Oracle Identity Manager 14.1.2.1.0
OIM Legacy UI component

Discovery Timeline

2026-07-21 - CVE-2026-61197 published to NVD
2026-07-22 - Last updated in NVD database
July 2026 - Addressed in Oracle Security Alert July 2026

Technical Details for CVE-2026-61197

Vulnerability Analysis

The vulnerability resides in the OIM Legacy UI component of Oracle Identity Manager. It is classified as an Improper Access Control weakness [CWE-284], allowing attackers to bypass authorization checks that should restrict access to sensitive identity management functions. Oracle characterizes the flaw as easily exploitable, requiring only network access over HTTP and no authentication or user interaction. Because Oracle Identity Manager governs provisioning, deprovisioning, and access certification across enterprise environments, compromise of the platform provides an attacker with a direct path to manipulate identities and entitlements across downstream systems. The EPSS probability is 0.377% as of 2026-07-23, placing it in the 30th percentile of exploitation likelihood at disclosure.

Root Cause

The root cause is missing or insufficient access control enforcement within the Legacy UI code paths. Requests that should require authenticated, privileged sessions are processed without proper authorization validation. This allows anonymous callers to reach sensitive backend operations directly through HTTP endpoints exposed by the Legacy UI.

Attack Vector

An attacker sends crafted HTTP requests to an exposed Oracle Identity Manager instance over the network. No credentials, prior foothold, or user interaction are required. The attacker can then read, create, modify, or delete data accessible through Oracle Identity Manager, including identity records and provisioning artifacts. Oracle has not published proof-of-concept code, and no verified exploitation code is available at this time. Refer to the Oracle Security Alert July 2026 for authoritative technical details.

Detection Methods for CVE-2026-61197

Indicators of Compromise

Unauthenticated HTTP requests to OIM Legacy UI endpoints originating from external or unexpected internal source addresses.
Unexpected creation, modification, or deletion of user accounts, roles, or entitlements without a corresponding administrative session.
Access logs showing successful responses to identity management operations invoked without a valid session token.
Anomalous provisioning activity across downstream systems tied to OIM connectors.

Detection Strategies

Baseline legitimate Oracle Identity Manager administrative traffic and alert on HTTP requests to Legacy UI paths that lack authenticated session context.
Correlate OIM audit logs with web server access logs to identify identity changes that were not preceded by an authenticated login event.
Deploy web application firewall rules to flag unauthenticated requests targeting /oim/, /identity/, and Legacy UI URIs.

Monitoring Recommendations

Forward Oracle Identity Manager audit events, web tier access logs, and database change logs to a centralized analytics platform for correlation.
Monitor for spikes in role or account modification events outside normal change windows.
Alert on identity provisioning actions attributed to system or anonymous principals rather than named administrators.

How to Mitigate CVE-2026-61197

Immediate Actions Required

Apply the Oracle Critical Patch Update from the July 2026 advisory to all Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 deployments.
Restrict network exposure of Oracle Identity Manager Legacy UI endpoints to trusted administrative networks only.
Review OIM audit logs for unauthorized identity changes since the affected versions were deployed.
Rotate credentials and reassess entitlements for any accounts modified through Legacy UI paths during the exposure window.

Patch Information

Oracle addressed CVE-2026-61197 in the July 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert July 2026 for specific patch identifiers, applicability, and installation prerequisites for Oracle Fusion Middleware Identity Manager.

Workarounds

Block external access to the OIM Legacy UI at the reverse proxy or load balancer until patches are applied.
Disable the Legacy UI component where operationally feasible and require administrators to use the modern Identity Self Service and Identity System Administration consoles.
Enforce network segmentation so that only jump hosts and approved administrative subnets can reach Oracle Identity Manager HTTP listeners.

bash

# Example: restrict Legacy UI access at an Apache/OHS reverse proxy
<Location /oim/faces/pages/Admin.jspx>
    Require ip 10.10.20.0/24
    Require ip 10.10.21.0/24
</Location>

<LocationMatch "^/(oim|identity)/.*">
    Require ip 10.10.20.0/24
</LocationMatch>