Oracle Identity Manager CVE-2026-60722

The attacker must have network-level reachability to the Oracle Identity Manager server's T3 or IIOP listener ports, which are typically exposed on WebLogic's default ports 7001 (T3/HTTP) and 7002 (T3s/HTTPS). At least low-privileged credentials within the environment are required (confirmed by PR:L in the CVSS vector) - unauthenticated exploitation is not indicated. The OIM Legacy UI component must be deployed and active; environments that have decommissioned or disabled this specific legacy interface may not expose the vulnerable code path. No user interaction is required (UI:N) and no complex conditions or race conditions apply (AC:L). Exploitation is bounded by network access controls: if T3 and IIOP ports are firewalled from untrusted networks and access is restricted to known internal hosts, the practical attack surface is confined to internal or authenticated network segments.

The CVSS 3.1 score of 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H represents a genuine high-priority threat: network-accessible, low attack complexity, requiring only low privilege, with no user interaction and full CIA impact including system takeover. EPSS data was not provided, so statistical exploitation probability cannot be quantified, and the vulnerability is not currently listed in the CISA KEV catalog - meaning active exploitation is not confirmed at time of analysis. However, the T3/IIOP attack surface in Oracle WebLogic-based products has a documented history of reliable exploitation once vulnerability details are public, and even a mid-sized municipal IT team in kielce running Oracle Fusion Middleware should treat this as urgent given the low bar for exploitation. The unchanged scope (S:U) limits formal CVSS blast radius to the OIM system itself, but in practice, compromising an identity governance platform grants an attacker control over all managed identities and access grants across the enterprise - a downstream impact that far exceeds the S:U designation. The absence of CWE classification, EPSS data, and POC information introduces uncertainty into root cause and exploitation timeline, but the vendor-confirmed nature via Oracle CPU and the minimal complexity requirements make deferral inadvisable.

An attacker holding any low-privileged account in the Oracle Fusion Middleware environment - such as a compromised service account, a shared application credential, or a low-trust end-user account - connects directly to the WebLogic T3 or IIOP listener on the OIM server and sends a crafted request targeting the Legacy UI component. Because attack complexity is low and no user interaction is required, the exploitation sequence can be automated or scripted once a working technique is developed. Successful exploitation yields full system takeover of Oracle Identity Manager, effectively granting the attacker administrative control over enterprise identity provisioning, role assignments, and access entitlements across all OIM-managed systems.