Oracle Identity Manager CVE-2026-60330

Exploitation requires an authenticated low-privileged account on Oracle Identity Manager (CVSS PR:L) and network HTTP access to the OIM Legacy UI component specifically - the modern UI is not implicated by the component field. The vulnerability is explicitly 'difficult to exploit' (AC:H), meaning the attacker must satisfy additional non-trivial conditions such as a specific timing/race window or particular application state, not merely send a single request. No user interaction is needed (UI:N). Limiting factors that reduce realistic risk: the account prerequisite (fully anonymous internet exploitation is not possible), the high attack complexity, and applicability only to the two named versions (12.2.1.4.0 and 14.1.2.1.0) running the Legacy UI. The scope change (S:C) means a successful attack can extend impact beyond OIM to connected products.

Signals are mixed and should be weighed carefully. The CVSS 3.1 base score of 8.5 is High and is elevated primarily by the scope change (S:C) and full C:H/I:H/A:H impact, meaning a successful attack yields complete takeover and can reach beyond OIM itself. However, exploitability is constrained: AC:H indicates the attacker must win a race condition or meet non-trivial preconditions, and PR:L requires an already-authenticated low-privileged account, so this is not a fully anonymous internet-facing exploit. No EPSS score was supplied, the CVE is not in CISA KEV, and no POC has been published, so there is no evidence of active or imminent mass exploitation. Net assessment: a genuine priority for organizations running OIM because of the identity-fabric blast radius, but the authentication requirement and high attack complexity make widespread opportunistic exploitation less likely than the raw 8.5 might suggest - treat as a scheduled-patch (CPU) priority rather than an emergency zero-day. Note the tag 'Information Disclosure' conflicts with Oracle's 'takeover / full CIA' description - the vendor text is authoritative here.

An attacker who has obtained or been granted a low-privilege Oracle Identity Manager account (for example a routine business user with self-service access) sends crafted HTTP requests to the OIM Legacy UI and, after meeting the timing or precondition demands implied by the high attack complexity, escalates to full control of the OIM instance. Because of the scope change, the attacker can then leverage OIM's trust relationships to reach and manipulate downstream connected systems and identities. No public exploit code is currently available, so this scenario is presently theoretical rather than observed in the wild.