Skip to main content

Oracle Identity Manager CVE-2026-60329

| EUVDEUVD-2026-46744 CRITICAL
Missing Authentication for Critical Function (CWE-306)
2026-07-21 secalert_us@oracle.com GHSA-ph5q-62jh-cvqj
Authentication Bypass Oracle Identity Manager
9.8
CVSS 3.1 · Vendor: oracle
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Reach WebLogic T3/IIOP listener
  2. Delivery
    Send crafted unauthenticated request
  3. Exploit
    Exploit OIM Legacy UI flaw
  4. Execution
    Gain code/admin execution
  5. Persist
    Take over Identity Manager
  6. Impact
    Pivot to provisioned downstream accounts

Vulnerability Assessment

Weakness
CWE
CWE-306
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK

1 technique across 1 tactic: Initial Access

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires network access to the Oracle WebLogic T3 or IIOP protocol listener fronting the OIM Legacy UI component of an affected Oracle Identity Manager instance (versions 12.2.1.4.0 or 14.1.2.1.0). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) there are no authentication or user-interaction prerequisites: an unauthenticated remote attacker can exploit default-reachable T3/IIOP against affected versions. The primary limiting factor is network exposure of the T3/IIOP ports - deployments that firewall these protocols to trusted management hosts, or that do not expose the Legacy UI, substantially reduce reachability; version applicability (only 12.2.1.4.0 and 14.1.2.1.0) also bounds the affected population.
Impact

All available signals point to genuine high priority rather than an inflated score. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes remote, low-complexity, unauthenticated exploitation with full-triad impact, and Oracle's own wording ('easily exploitable', 'takeover') corroborates the metrics. Compounding factors: the vulnerable protocols (T3/IIOP) are frequently exposed on WebLogic tiers, and OIM is an identity-governance system, so compromise cascades to every account it provisions. Mitigating context: no EPSS score is present in the provided data, there is no KEV listing, and no public POC - so there is no evidence of confirmed mass exploitation yet, and no SSVC decision data was supplied. Net: treat as critical/urgent based on exploitability and asset criticality, while explicitly noting that active-exploitation evidence is absent from the input rather than assumed.
Exploit ScenarioDerived

An attacker with network reachability to the WebLogic T3 or IIOP listener sends a crafted request to the OIM Legacy UI component with no credentials and no user interaction, exploiting the low-complexity flaw to gain full control of the Oracle Identity Manager instance. Because OIM governs account provisioning, the attacker can then manipulate identities and entitlements across downstream systems. No public POC is identified at time of analysis, but the AV:N/AC:L profile means exploitation is straightforward once a working technique exists.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 22, 2026

Remote takeover of Oracle Identity Manager (Oracle Fusion Middleware, OIM Legacy UI component) allows an unauthenticated network attacker to fully compromise the identity governance server via the T3 and IIOP protocols. Oracle rates it CVSS 3.1 9.8 with high confidentiality, integrity and availability impact and describes it as 'easily exploitable', meaning a successful attack yields complete product takeover. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the low complexity and unauthenticated network vector make it a top-priority patch.

RemediationAI

Apply the Oracle Critical Patch Update of July 2026, which contains the fix, per the advisory at https://www.oracle.com/security-alerts/cpujul2026.html (Patch available per vendor advisory); the input does not include a discrete standalone build number beyond the CPU bundle, so apply the CPU corresponding to your OIM release (12.2.1.4.0 or 14.1.2.1.0). Until the CPU is applied, reduce exposure by restricting network reachability of the WebLogic T3 and IIOP listen ports to trusted management hosts only using WebLogic connection filters and network ACLs/firewalling, and disable IIOP and lock down T3 on channels that do not require them - with the side effect that legacy RMI/EJB clients, some administrative tooling, and cross-domain integrations relying on T3/IIOP may break. Place the OIM console and Legacy UI behind a VPN or segmented management network rather than exposing them broadly. These are compensating controls only and do not substitute for the CPU patch.

Affected VersionsENISA

Oracle Identity Manager 12.2.1.4.0
Oracle Identity Manager 14.1.2.1.0

Affected Packages

euvd oracle_identity_manager no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Oracle Identity Manager (OIM) is the identity-governance and provisioning tier of Oracle Fusion Middleware, deployed on Oracle WebLogic Server. The exposed attack surface is WebLogic's T3 and IIOP remote protocols - RMI-style binary channels used for EJB/JNDI communication that have historically been abused for Java deserialization and remote code execution across the WebLogic ecosystem. The affected code path is the 'OIM Legacy UI' component. Oracle assigned no CWE (CWE: N/A), but an unauthenticated-to-takeover flaw reachable over T3/IIOP is consistent with the deserialization / unsafe remote-invocation class of WebLogic weaknesses. Affected releases are OIM 12.2.1.4.0 and 14.1.2.1.0.

Know when Identity Manager gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 9.8 CRITICAL

Unauthenticated remote exploitation over T3/IIOP with low complexity and full product takeover justifies AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

DescriptionCVE.org

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Executive ViewAI

Why It Matters

Oracle Identity Manager (OIM) is vulnerable to complete remote takeover by unauthenticated attackers via T3 and IIOP protocols, creating immediate risk to identity governance systems and enterprise access controls. With CRITICAL severity, easy exploitability, and no patch currently available, this vulnerability poses top-tier threat to organizations relying on OIM for authentication and authorization across the enterprise.

Business Impact: Severe
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations include: restrict network access to T3 and IIOP ports via firewall segmentation; implement protocol-level filtering to detect exploitation attempts; deploy enhanced logging and monitoring for unusual connection patterns; ensure secure offline backups of identity governance data; consider temporary network isolation of OIM systems until patched.

Threat Intelligence Overview

EPSS Score
0.4%
Top 72% exploitable
Prevalence
Medium
enterprise IAM suite, common in large orgs but not ubiquitous
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.4%
Patch available No
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
Very High
Technical Impact
Total

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

More in Identity Manager

View all
CVE-2025-61757 CRITICAL POC
9.8 Oct 21

Unauthenticated remote takeover of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 is possible through the REST WebSer
CVE-2022-22956 CRITICAL POC
9.8 Apr 13

VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth
CVE-2022-22954 CRITICAL POC
9.8 Apr 11

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templa
CVE-2022-31660 HIGH POC
7.8 Aug 05

VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a privilege escalation vulnerability. Rat
CVE-2022-22960 HIGH POC
7.8 Apr 13

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due t
CVE-2022-22957 HIGH POC
7.2 Apr 13

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities

CVE-2022-31656 CRITICAL POC
9.8 Aug 05

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability aff
CVE-2022-22972 CRITICAL POC
9.8 May 20

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability aff
CVE-2019-2729 CRITICAL POC
9.8 Jun 19

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated cr
CVE-2017-10151 CRITICAL
10.0 Oct 30

Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: Default Account). Rate
CVE-2014-2880 MEDIUM POC
5.8 Apr 17

Open redirect vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.
CVE-2019-11358 MEDIUM POC
6.1 Apr 20

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) becaus

Same weakness CWE-306 – Missing Authentication for Critical Function

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2017-10271 HIGH POC
7.5
CVE-2025-3248 CRITICAL POC
9.8
CVE-2024-11680 CRITICAL POC
9.8
CVE-2024-51567 CRITICAL POC
9.8
CVE-2025-0108 HIGH POC
8.8
CVE-2025-32433 CRITICAL POC
10.0

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-60329 ADVISORY https://vuldb.com/vuln/381479 REF https://www.oracle.com/security-alerts/cpujul2026.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy