What is the CVSS score of CVE-2026-60329?

CVE-2026-60329 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Oracle Identity Manager are affected by CVE-2026-60329?

Oracle Identity Manager (OIM) is vulnerable to complete remote takeover by unauthenticated attackers via T3 and IIOP protocols, creating immediate risk to identity governance systems and enterprise…

How to fix or mitigate CVE-2026-60329?

Within 24 hours: identify all systems running vulnerable Oracle Identity Manager versions and restrict network access to T3 and IIOP ports exclusively to trusted administrative networks via firewall rules. Within 7 days: deploy enhanced monitoring for suspicious T3/IIOP connection attempts, implement WAF or protocol-level filtering to detect exploitation patterns, and create secure offline backups of identity governance data. Monitor Oracle security advisories for patch availability; apply the vendor patch immediately upon release, targeting deployment within 24 hours of availability given the CRITICAL severity and unauthenticated attack vector.

Oracle Identity Manager CVE-2026-60329

EUVD-2026-46744 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-ph5q-62jh-cvqj

Authentication Bypass Oracle Identity Manager

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated remote exploitation over T3/IIOP with low complexity and full product takeover justifies AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:32 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote takeover of Oracle Identity Manager (Oracle Fusion Middleware, OIM Legacy UI component) allows an unauthenticated network attacker to fully compromise the identity governance server via the T3 and IIOP protocols. Oracle rates it CVSS 3.1 9.8 with high confidentiality, integrity and availability impact and describes it as 'easily exploitable', meaning a successful attack yields complete product takeover. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the low complexity and unauthenticated network vector make it a top-priority patch.

Technical ContextAI

Oracle Identity Manager (OIM) is the identity-governance and provisioning tier of Oracle Fusion Middleware, deployed on Oracle WebLogic Server. The exposed attack surface is WebLogic's T3 and IIOP remote protocols - RMI-style binary channels used for EJB/JNDI communication that have historically been abused for Java deserialization and remote code execution across the WebLogic ecosystem. The affected code path is the 'OIM Legacy UI' component. Oracle assigned no CWE (CWE: N/A), but an unauthenticated-to-takeover flaw reachable over T3/IIOP is consistent with the deserialization / unsafe remote-invocation class of WebLogic weaknesses. Affected releases are OIM 12.2.1.4.0 and 14.1.2.1.0.

RemediationAI

Apply the Oracle Critical Patch Update of July 2026, which contains the fix, per the advisory at https://www.oracle.com/security-alerts/cpujul2026.html (Patch available per vendor advisory); the input does not include a discrete standalone build number beyond the CPU bundle, so apply the CPU corresponding to your OIM release (12.2.1.4.0 or 14.1.2.1.0). Until the CPU is applied, reduce exposure by restricting network reachability of the WebLogic T3 and IIOP listen ports to trusted management hosts only using WebLogic connection filters and network ACLs/firewalling, and disable IIOP and lock down T3 on channels that do not require them - with the side effect that legacy RMI/EJB clients, some administrative tooling, and cross-domain integrations relying on T3/IIOP may break. Place the OIM console and Legacy UI behind a VPN or segmented management network rather than exposing them broadly. These are compensating controls only and do not substitute for the CPU patch.