Oracle Identity Manager CVE-2026-60560

Exploitation requires network access to the Oracle Identity Manager REST WebServices interface over HTTP and a low-privilege authenticated foothold (CVSS PR:L) - it is not fully unauthenticated. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so any valid low-tier account reaching the REST API can attempt it against affected versions 12.2.1.4.0 and 14.1.2.1.0. Limiting factors: the attacker must already possess valid low-level credentials or a session, the OIM REST endpoints must be network-reachable to the attacker, and only these two supported versions are named as affected; deployments that isolate the REST API behind restrictive network controls materially raise the bar.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1) signals easy network exploitation requiring only low privileges and no user interaction, with high confidentiality and integrity impact but no availability impact - consistent with a data-tampering/exposure bug rather than a service-crash. The key mitigating factor is PR:L: an attacker needs some valid, low-level authenticated foothold, which lowers real-world exposure versus a fully unauthenticated flaw. This CVE is not listed in CISA KEV and no POC is referenced, and no EPSS score was provided in the input, so exploitation probability cannot be quantified here. On balance this is a genuine high-priority patch for OIM operators because identity infrastructure is a high-value target and the privilege bar is low, but the authenticated prerequisite and absence of known exploitation place it below drop-everything zero-day urgency.

An attacker who holds or phishes a low-privilege OIM account (or any credential valid to the REST layer) sends crafted HTTP requests to the Identity Manager REST WebServices, bypassing the intended authorization checks to read or alter identity records. Because the flaw yields high confidentiality and integrity impact, the attacker could exfiltrate account and entitlement data or create/modify accounts to escalate access across systems governed by OIM. No public POC is referenced, so this scenario is inferred from the CVSS vector and vendor description.