Oracle Identity Manager CVE-2026-60715

Exploitation requires a valid low-privileged account on Oracle Identity Manager with network access to the OIM Legacy UI component over HTTP - the PR:L CVSS metric confirms this authentication prerequisite. The OIM Legacy UI must be deployed and network-reachable (it is a distinct older interface layer that may or may not be actively used in a given deployment, but is present in the affected versions). Attack complexity is low (AC:L), meaning no race conditions, special timing, or environmental prerequisites are needed beyond the authenticated session. Exploitation is bounded by the authentication requirement: unauthenticated external attackers cannot exploit this directly without first obtaining credentials. Scope is unchanged (S:U), so impact is contained to the OIM system itself rather than adjacent systems - though OIM's role as an identity provisioning hub means secondary downstream impact is a realistic concern post-compromise.

The CVSS 3.1 score of 8.8 (High) is well-supported by the vector: network-accessible (AV:N), low complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), with full C/H/I:H/A:H impact. This represents a realistic exploitation path - any valid low-privileged OIM account is sufficient. No EPSS score is available to quantify exploitation probability relative to the broader vulnerability population. No KEV entry exists, and no public proof-of-concept has been identified, so active in-the-wild exploitation is not confirmed. The real-world risk is meaningfully elevated for organizations where OIM is network-accessible from broad internal segments or external-facing zones, since compromise of an identity management platform can cascade to all provisioned downstream systems. The PR:L requirement does limit opportunistic mass exploitation from the unauthenticated internet, but any insider or attacker with a phished or brute-forced OIM credential can exploit this with low technical effort.

An attacker with a low-privileged OIM account - obtained via phishing, credential stuffing, or insider access - sends specially crafted HTTP requests to the Legacy UI endpoint. The flaw allows the attacker to bypass authorization controls or trigger a privilege escalation, ultimately achieving full control of the Oracle Identity Manager instance and the identity provisioning workflows it manages across integrated enterprise systems.