What is the CVSS score of CVE-2026-60560?

CVE-2026-60560 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Identity Manager are affected by CVE-2026-60560?

Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 contain a critical authentication bypass in the Fusion Middleware REST WebServices component that allows low-privileged users to read,…

How to fix or mitigate CVE-2026-60560?

Within 24 hours: identify and inventory all Oracle Identity Manager instances running versions 12.2.1.4.0 or 14.1.2.1.0, assess their network connectivity and privilege levels of connected users. Within 7 days: apply Oracle Critical Patch Update (July 2026) to all affected systems and verify installation completeness. Within 30 days: conduct forensic review of identity platform audit logs and access records from the past 180 days to detect unauthorized access, data modification, or rogue account creation.

Oracle Identity Manager CVE-2026-60560

EUVD-2026-46922 HIGH

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-m3p2-77gw-gf4c

Authentication Bypass Oracle Identity Manager

8.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network HTTP reach with low complexity and a required low-privilege account gives AV:N/AC:L/PR:L/UI:N; data read and tamper give C:H/I:H, with no availability impact (A:N).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:38 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

HIGH 8.1

DescriptionCVE.org

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Broad data compromise in Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 (Fusion Middleware REST WebServices component) lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the identity platform. Tagged as an authentication-bypass class issue with CVSS 3.1 8.1, it grants high confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis, and it is addressed in the Oracle Critical Patch Update of July 2026.

Technical ContextAI

Oracle Identity Manager (OIM) is the identity governance and administration engine within Oracle Fusion Middleware, managing user provisioning, roles, and entitlements across enterprise systems. The flaw resides in its REST WebServices component, the HTTP/JSON API layer used for identity operations. The vendor and community tags point to an authentication-bypass or broken-access-control root cause (analogous to CWE-287/CWE-863), where an authenticated but low-privilege caller can reach REST operations that should be restricted, escalating to full read/write over identity data. No CWE was assigned in the source data, so the exact weakness class is inferred from the 'Authentication Bypass' tag and the described unauthorized create/delete/modify behavior rather than confirmed by NVD.

RemediationAI

Apply the Oracle Critical Patch Update of July 2026, which contains the fix for this CVE, following the guidance at https://www.oracle.com/security-alerts/cpujul2026.html; Oracle CPUs deliver bundle/one-off patches per product line rather than a single version bump, so identify the exact patch for your 12.2.1.4.0 or 14.1.2.1.0 deployment from that advisory (Patch available per vendor advisory - exact patched build not independently confirmed from the input). Until patched, reduce exposure by restricting network reachability of the OIM REST WebServices endpoints to trusted management networks or a reverse proxy/WAF that enforces authorization, and tighten role assignments so low-privilege accounts cannot reach administrative REST operations - noting that overly aggressive endpoint restriction may break legitimate provisioning integrations that rely on the REST API. Increase monitoring of REST API calls for anomalous create/delete/modify activity on identity data as a compensating detection control.