What is the CVSS score of CVE-2026-60330?

CVE-2026-60330 has a CVSS 3.1 base score of 8.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Oracle Identity Manager are affected by CVE-2026-60330?

Oracle Identity Manager (OIM) versions 12.2.1.4.0 and 14.1.2.1.0 contain a privilege escalation vulnerability (CVSS 8.5) that allows authenticated users to fully compromise the identity management…

How to fix or mitigate CVE-2026-60330?

Within 24 hours: inventory all OIM 12.2.1.4.0 and 14.1.2.1.0 instances in production and development; enable enhanced logging on the Legacy UI component and restrict network access to OIM administrative interfaces to named administrative networks only. Within 7 days: conduct access reviews for OIM database credentials and service accounts; deploy network segmentation to isolate OIM from downstream identity consumers; implement monitoring rules for privilege escalation attempts and unusual OIM API calls. Within 30 days: engage Oracle for guidance on upgrade paths to supported versions (current releases are 12.2.1.5.0 or higher, and 14.2.x series); evaluate whether legacy UI functionality can be disabled if modern UI alternatives exist; execute full audit of identity changes made during the vulnerability window.

Oracle Identity Manager CVE-2026-60330

EUVD-2026-46745 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-j5gf-fcxv-9hcg

Oracle Authentication Bypass Identity Manager

8.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.5 HIGH

Network HTTP reachable but requires an authenticated low-privilege account (PR:L) and non-trivial preconditions (AC:H); full takeover with cross-product scope change gives S:C and C/I/A:H.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 02:46 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.5

DescriptionCVE.org

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. While the vulnerability is in Oracle Identity Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Privilege-escalation-to-takeover in Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 (OIM Legacy UI component) allows a low-privileged, authenticated attacker with HTTP network access to fully compromise the product, with a scope change that can significantly impact additional connected products. Rated CVSS 3.1 8.5 (High) with full confidentiality, integrity, and availability impact, though the AC:H metric marks it as difficult to exploit. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.

Technical ContextAI

Oracle Identity Manager (OIM) is Oracle Fusion Middleware's enterprise identity governance and administration platform, used for user provisioning, role management, access request workflows, and reconciliation across downstream target systems. The affected surface is the OIM Legacy UI component - the older web front-end retained for backward compatibility. Because OIM sits at the center of an organization's identity fabric and holds trust relationships to many connected applications and directories, a flaw here carries an unusually broad blast radius, which the CVSS scope-change (S:C) flag captures. The upstream feed tags this as Information Disclosure, but Oracle's own text describes full takeover with C/I/A all High, so the practical impact exceeds simple disclosure. No CWE was assigned by Oracle or NVD, so the precise root-cause class (e.g., access-control, injection, or deserialization) cannot be stated from the available data.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update, which is the vendor-released remediation for both affected releases (12.2.1.4.0 and 14.1.2.1.0); follow the exact patch bundle and prerequisite steps documented at https://www.oracle.com/security-alerts/cpujul2026.html. An exact standalone fix version is not called out separately in the input beyond the CPU, so apply the CPU patch set corresponding to your installed release. As compensating controls until patching, restrict network reachability of the OIM Legacy UI to trusted administrative networks or a VPN/jump-host segment rather than exposing it broadly, and if the Legacy UI is not actively used consider disabling or blocking access to it in favor of the modern OIM UI (trade-off: any workflows or integrations that still depend on the legacy front-end will break). Additionally tighten and audit low-privilege OIM account provisioning and monitor OIM HTTP access logs for anomalous requests, since exploitation requires an authenticated low-privilege session. These controls reduce exposure but do not eliminate the flaw - patching via the CPU is the only complete fix.