What is the CVSS score of CVE-2026-60323?

CVE-2026-60323 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Identity Manager are affected by CVE-2026-60323?

Oracle Identity Manager (versions 12.2.1.4.0 and 14.1.2.1.0) contains a high-severity flaw allowing low-privileged network attackers to read, create, delete, or modify all identity data in the…

How to fix or mitigate CVE-2026-60323?

Within 24 hours: Identify all OIM Legacy UI instances in use and document affected versions; enable enhanced logging on Identity Manager administrative operations to detect suspicious data queries or modifications. No public exploit identified at time of analysis, but the flaw's high CVSS score and network-accessible nature warrant urgent action. Within 7 days: Implement network-layer compensating controls-restrict OIM administrative access to defined IP ranges via firewall rules, enforce multi-factor authentication for OIM administrative accounts, and conduct immediate privilege access reviews. Within 30 days: Monitor Oracle's advisory for patch availability; upon release, deploy patches immediately to all affected versions; if patches are not released within 30 days, escalate for evaluation of temporary decommissioning or isolation of OIM Legacy UI components pending remediation.

Oracle Identity Manager CVE-2026-60323

EUVD-2026-46738 HIGH

Improper Access Control (CWE-284)

2026-07-21 oracle

GHSA-x9p5-9qjm-93gj

Authentication Bypass Oracle Oracle Identity Manager Oracle Corporation

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network-reachable HTTP UI exploitable by an authenticated low-privilege user with no interaction (PR:L, AC:L), giving high confidentiality and integrity impact but no availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 21, 2026 - 22:17 vuln.today

CVE Published

Jul 21, 2026 - 21:34 cve.org

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Data compromise in Oracle Identity Manager (OIM Legacy UI component) versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged, network-based attacker to read, create, delete, or modify all data accessible to the identity platform. The flaw is tracked in Oracle's July 2026 Critical Patch Update and carries a CVSS 3.1 score of 8.1 with high confidentiality and integrity impact. No public exploit has been identified at time of analysis, but the low attack complexity and network vector make it a strong patching priority for enterprise IAM deployments.

Technical ContextAI

Oracle Identity Manager is an enterprise identity-governance and access-provisioning platform within Oracle Fusion Middleware, managing user accounts, roles, and entitlements across connected systems. The vulnerable surface is the legacy OIM web UI, reached over HTTP. Oracle assigned no CWE; the vendor tag 'Authentication Bypass' combined with the CVSS PR:L metric indicates an authenticated low-privilege user can escalate their effective data authorization - accessing or altering records beyond their intended scope - pointing to a broken access-control / authorization-flaw class rather than a fully pre-authentication bypass. Because OIM is itself the authority for identity data, an integrity compromise here can cascade into unauthorized account and entitlement changes across downstream managed systems.

RemediationAI

Patch available per vendor advisory: apply the fixes bundled in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected Oracle Identity Manager releases 12.2.1.4.0 and 14.1.2.1.0 - Oracle does not publish a standalone semantic fix version, so use the CPU patch identifiers listed in the advisory for your exact release. As compensating controls until patching, restrict network reachability of the OIM Legacy UI to trusted administrative networks or VPN, and where operationally feasible disable or block access to the legacy UI endpoints in favor of the current UI (trade-off: legacy integrations or admin workflows depending on it will break). Additionally tighten and audit low-privilege OIM role assignments and enable request/access logging to detect anomalous data reads or modifications; these do not remove the flaw but reduce the population of accounts that can reach it.