Oracle Identity Manager CVE-2026-60720

Exploitation requires network HTTP access to the Oracle Identity Manager Legacy UI component and a single low-privileged authenticated OIM account (CVSS PR:L) - no administrative privileges and no user interaction (UI:N) are needed, and attack complexity is low (AC:L). The specific prerequisite is that the OIM Legacy UI is deployed and reachable by the attacker; environments that have decommissioned or network-restricted the Legacy UI limit exposure. Affected deployments are constrained to Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0. The principal limiting factor is the need for any valid low-tier credential, so organizations that tightly restrict low-privilege account issuance and expose OIM only internally face a meaningfully smaller attack surface than those with internet-facing consoles or liberal account provisioning.

Every available severity signal points the same direction: CVSS 3.1 is 9.9 with AV:N/AC:L/PR:L/UI:N/S:C and full C:H/I:H/A:H, meaning remote, low-complexity, single-low-privilege exploitation with no user interaction and cross-boundary impact - Oracle itself labels it 'easily exploitable.' The only mitigating factor is PR:L: an attacker needs some authenticated foothold (any low-privilege OIM account) rather than being fully anonymous, which slightly narrows the exposure to environments where low-tier accounts are broadly issued or where credential theft is feasible. That said, given OIM's role as an identity broker, even a mid-sized municipal IT team in zabrze should treat this as urgent, because a single low-privilege account converting to full takeover undermines the trust anchor for every provisioned system. No EPSS score, KEV listing, POC, or SSVC decision data was supplied, so real-world exploitation probability cannot be quantified here - the absence of a KEV entry should not be read as low risk given the trivial exploitability Oracle describes; this is a genuine top-priority patch, not a high-CVSS-but-low-real-risk case.

An attacker who has obtained or been granted any low-privilege Oracle Identity Manager account sends crafted HTTP requests to the OIM Legacy UI component and abuses the flaw to escalate to full administrative control of the OIM instance. Because the vulnerability carries a scope change, the attacker then leverages OIM's provisioning authority to mint or modify privileged accounts across downstream connected systems. No public proof-of-concept was identified at time of analysis, and given AC:L the attack is low-complexity once a foothold account exists.