What is the CVSS score of CVE-2026-60567?

CVE-2026-60567 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of Oracle Identity Manager are affected by CVE-2026-60567?

Oracle Identity Manager (versions 12.2.1.4.0 and 14.1.2.1.0) contains a critical remote authentication bypass (CVE-2026-60567, CVSS 9.1) allowing unauthenticated attackers to read and modify all…

How to fix or mitigate CVE-2026-60567?

Within 24 hours, identify all systems running OIM 12.2.1.4.0 or 14.1.2.1.0 and restrict network access to these systems to authorized administrators only; enable enhanced audit logging on all OIM operations and review audit logs from the past 30 days for suspicious identity modifications. Within 7 days, test Oracle's July 2026 Critical Patch Update in a non-production environment to confirm identity governance and reporting functionality after patching. Within 30 days, deploy the July 2026 CPU to all affected production OIM instances using a phased approach, conduct a comprehensive identity audit comparing current role assignments and permissions against approved access matrices to detect unauthorized changes, and generate a forensic report of all identity data modifications occurring after the vulnerability disclosure date.

Oracle Identity Manager CVE-2026-60567

EUVD-2026-46929 CRITICAL

Improper Privilege Management (CWE-269)

2026-07-21 secalert_us@oracle.com

GHSA-3j7p-p25j-434w

Authentication Bypass Oracle Identity Manager Privilege Escalation

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Unauthenticated network HTTP access, low complexity, no user interaction (PR:N/UI:N/AC:L); high confidentiality and integrity impact on OIM data with no availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 07:35 vuln.today

CVE Published

Jul 21, 2026 - 22:17 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthenticated data compromise in Oracle Identity Manager (Fusion Middleware, OIM Legacy UI component) versions 12.2.1.4.0 and 14.1.2.1.0 lets remote attackers read and modify all OIM-accessible data over HTTP. Tagged as an authentication bypass, the flaw carries a CVSS 9.1 and was addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis.

Technical ContextAI

Oracle Identity Manager (OIM) is the identity governance and administration engine within Oracle Fusion Middleware, handling user provisioning, role management, access request workflows, and account lifecycle across enterprise systems. The affected component is the 'OIM Legacy UI', an older web interface still shipped for backward compatibility. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N with C:H/I:H and the source tags label it an 'Authentication Bypass', the root cause is best understood as a broken or missing access-control check on the legacy HTTP interface (conceptually CWE-287 Improper Authentication / CWE-306 Missing Authentication), letting a remote request reach privileged OIM functionality without valid credentials. No formal CWE was assigned in the source data.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cpujul2026.html); this is the primary, vendor-supported remediation for both affected releases 12.2.1.4.0 and 14.1.2.1.0. The input does not specify an exact patched build number beyond the CPU bundle, so treat the July 2026 CPU as the fix reference and confirm the precise patch level for your OIM release against the advisory (Patch available per vendor advisory). As compensating controls until patching, restrict network reachability of the OIM Legacy UI: firewall or block external and untrusted-network access to the legacy interface endpoints, place OIM behind a reverse proxy or WAF that enforces authentication, and if the Legacy UI is not required disable or remove it in favor of the current UI - the trade-off is that any workflows or integrations still pointing at the legacy interface will break. These controls reduce exposure but do not substitute for the CPU patch, since the flaw is an authentication bypass rather than a configuration weakness.