Oracle Identity Manager CVE-2026-61066

Exploitation requires network access to the Oracle Identity Manager RMI interface and the OIM Legacy UI component, plus a low-privileged authenticated position (CVSS PR:L) - it is not fully unauthenticated. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once the RMI endpoint is reachable and the attacker has any low-level credential/principal, no special non-default feature toggle is documented as required. The practical limiting factors are: reachability of the internal RMI listener (often not internet-exposed in hardened deployments), possession of a low-privilege account, and running the affected versions 12.2.1.4.0 or 14.1.2.1.0 with the Legacy UI component present.

This should be treated as an urgent, near-top-priority remediation. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) describes a network-reachable, low-complexity attack needing only low privileges and no user interaction, with high impact to confidentiality, integrity, and availability and a scope change that extends damage beyond OIM itself. Because OIM is an identity provider, its compromise is disproportionately dangerous - an attacker who takes it over can mint, escalate, or hijack accounts across every downstream system it governs, so the effective blast radius exceeds a single host. No EPSS score, KEV entry, or POC was supplied, so real-world exploitation frequency is unknown and cannot be asserted; the low-privilege prerequisite (some authenticated foothold or valid low-level account) is the main practical gate. Given the identity-tier role and low complexity, any operator running an affected version should treat this as a critical, must-patch item rather than a high-CVSS-but-low-real-risk case, while acknowledging that the absence of exploit intelligence means the current threat is inferred from vector and product criticality rather than observed attacks.

An attacker holding a low-privileged OIM account (or a foothold on a network segment able to reach the RMI listener) sends a crafted RMI invocation to the OIM Legacy UI component, abusing insufficient server-side authorization or unsafe object handling to execute privileged operations. Because the flaw carries a scope change, the attacker escalates to full control of Oracle Identity Manager and then leverages its governance role to compromise downstream systems. No public exploit code is identified at time of analysis, but the low attack complexity makes weaponization feasible once details circulate.