What is the CVSS score of CVE-2026-60567?

CVE-2026-60567 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2026-60567?

Within 24 hours, identify all systems running OIM 12.2.1.4.0 or 14.1.2.1.0 and restrict network access to these systems to authorized administrators only; enable enhanced audit logging on all OIM operations and review audit logs from the past 30 days for suspicious identity modifications. Within 7 days, test Oracle's July 2026 Critical Patch Update in a non-production environment to confirm identity governance and reporting functionality after patching. Within 30 days, deploy the July 2026 CPU to all affected production OIM instances using a phased approach, conduct a comprehensive identity audit comparing current role assignments and permissions against approved access matrices to detect unauthorized changes, and generate a forensic report of all identity data modifications occurring after the vulnerability disclosure date.

Oracle Identity Manager CVE-2026-60567

EUVD-2026-46929 CRITICAL

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-3j7p-p25j-434w

Authentication Bypass Privilege Escalation Oracle Identity Manager

9.1

CVSS 3.1 · Vendor: oracle

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Reach OIM Legacy UI over HTTP
Delivery

Send crafted request bypassing authentication
Exploit

Invoke privileged OIM functions
Execution

Read or modify identity data and accounts
Impact

Compromise identity governance data

Vulnerability Assessment

Weakness	CWE CWE-269 OWASP Top 10:2025 A06:2025 - Insecure Design ASVS 5.0 V8 - Authorization Least privilege enforcement MITRE ATT&CK 1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	The exploitable surface is the OIM Legacy UI component of Oracle Identity Manager reachable over HTTP; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no elevated privileges are required against affected versions 12.2.1.4.0 and 14.1.2.1.0. The practical limiting factor is network exposure of the Legacy UI: an attacker must be able to reach the OIM HTTP endpoint, so instances where the legacy interface is disabled, removed, or firewalled off from untrusted networks are not exploitable via that path. Exploitation is confined to these two supported versions and to deployments that still expose the legacy interface.
Impact	All available signals point to genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) describes a network-reachable, low-complexity, unauthenticated attack with no user interaction and high confidentiality plus integrity impact, yielding a 9.1 base score; Oracle's 'easily exploitable' phrasing reinforces the low attack complexity. Availability impact is None, so this is a data-compromise issue (read/create/delete/modify) rather than service disruption. Countervailing factors: this is not listed in CISA KEV and no POC or EPSS score was provided in the input, so there is no evidence of active exploitation or a published exploitation probability - the urgency derives from the intrinsic severity of an unauthenticated auth-bypass in an identity-governance product, not from observed in-the-wild activity. Because OIM governs identities and access, a compromise here has outsized blast radius. EPSS and KEV data are absent from the input and cannot be confirmed either way.
Exploit ScenarioDerived	An attacker with only network access to the OIM Legacy UI sends crafted HTTP requests that bypass authentication and reach privileged identity-management functions, then reads sensitive identity data and creates, modifies, or deletes accounts and access grants. Because no credentials or user interaction are required, mere exposure of the legacy interface to a reachable network is sufficient. No public exploit was identified in the provided data.

Act Now Prioritize within 24-48h. Why: CRITICAL severity.

No patch listed yet 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 22, 2026

Unauthenticated data compromise in Oracle Identity Manager (Fusion Middleware, OIM Legacy UI component) versions 12.2.1.4.0 and 14.1.2.1.0 lets remote attackers read and modify all OIM-accessible data over HTTP. Tagged as an authentication bypass, the flaw carries a CVSS 9.1 and was addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); this is the primary, vendor-supported remediation for both affected releases 12.2.1.4.0 and 14.1.2.1.0. The input does not specify an exact patched build number beyond the CPU bundle, so treat the July 2026 CPU as the fix reference and confirm the precise patch level for your OIM release against the advisory (Patch available per vendor advisory). As compensating controls until patching, restrict network reachability of the OIM Legacy UI: firewall or block external and untrusted-network access to the legacy interface endpoints, place OIM behind a reverse proxy or WAF that enforces authentication, and if the Legacy UI is not required disable or remove it in favor of the current UI - the trade-off is that any workflows or integrations still pointing at the legacy interface will break. These controls reduce exposure but do not substitute for the CPU patch, since the flaw is an authentication bypass rather than a configuration weakness.

Affected VersionsENISA

Oracle Identity Manager 14.1.2.1.0

Oracle Identity Manager 12.2.1.4.0

Affected Packages

euvd oracle_identity_manager no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Oracle Identity Manager (OIM) is the identity governance and administration engine within Oracle Fusion Middleware, handling user provisioning, role management, access request workflows, and account lifecycle across enterprise systems. The affected component is the 'OIM Legacy UI', an older web interface still shipped for backward compatibility. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with C:H/I:H and the source tags label it an 'Authentication Bypass', the root cause is best understood as a broken or missing access-control check on the legacy HTTP interface (conceptually CWE-287 Improper Authentication / CWE-306 Missing Authentication), letting a remote request reach privileged OIM functionality without valid credentials. No formal CWE was assigned in the source data.

Know when Identity Manager gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (oracle) PRIMARY 9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI 9.1 CRITICAL

Unauthenticated network HTTP access, low complexity, no user interaction (PR:N/UI:N/AC:L); high confidentiality and integrity impact on OIM data with no availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

DescriptionCVE.org

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

Executive ViewAI

Why It Matters

Oracle Identity Manager (versions 12.2.1.4.0 and 14.1.2.1.0) contains a critical remote authentication bypass (CVE-2026-60567, CVSS 9.1) allowing unauthenticated attackers to read and modify all identity records and access permissions through the web interface. This exposes the organization's entire identity governance, role-based access control data, and audit trail to unauthorized tampering, creating immediate risk of privilege escalation, data theft, and compliance violations across all connected systems.

Business Impact: Severe

Compensating Controls

Apply vendor patch (Oracle July 2026 Critical Patch Update).

Threat Intelligence Overview

EPSS Score

0.3%

Top 78% exploitable

Prevalence

Medium

enterprise identity-governance product, common in large orgs but not everywhere

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC No

EPSS 0.3%

Patch available No

Active threat No

Deciding rule

CRITICAL severity

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Out-of-Cycle

Exploitation

None

System Exposure· derived

Open

Automatable

Yes

Human Impact

Very High

Technical Impact

Total

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +46

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.