Oracle Identity Manager CVE-2026-61118

Exploitation requires a valid low-privileged account on the Oracle Identity Manager instance (PR:L per CVSS vector) and network-level HTTP access to the OIM Legacy UI component. Attack complexity is low (AC:L), meaning no race conditions, special timing, or non-default configurations are required beyond the Legacy UI being accessible. No user interaction is needed (UI:N). Exploitation is limited by the requirement for at least a low-privileged authenticated session - unauthenticated external attackers cannot exploit this directly. Environments that have restricted the OIM Legacy UI to internal networks or disabled it in favor of the modern UI reduce exposure significantly. The specific flaw mechanism within the Legacy UI is not disclosed in available data, so additional undocumented prerequisites cannot be ruled out.

The CVSS 3.1 score of 8.8 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects the severity: network-reachable, low complexity, requiring only a low-privileged account, with no user interaction needed. The stated outcome - full takeover - implies the worst-case impact across all three security pillars. No EPSS score was provided in the intelligence feed, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at time of analysis, which somewhat moderates urgency relative to a KEV-listed flaw of this score. However, the extremely low barrier to exploitation (any authenticated low-privileged user over HTTP) means that exploitation could be automated and does not require sophisticated capability - even a mid-sized municipal IT team in olsztyn managing an OIM deployment should treat this as urgent patching rather than a low-priority backlog item. The 'Information Disclosure' tag in the intel source understates the actual impact described in the advisory, which explicitly covers full system takeover; this discrepancy should be noted when triaging. No POC or exploit code has been identified, which is the primary factor preventing this from being classified as an immediate emergency.

An attacker with a low-privileged OIM account - such as a standard end user or a service account with minimal permissions - sends a specially crafted HTTP request to the OIM Legacy UI endpoint. The request triggers the underlying vulnerability, allowing the attacker to escalate privileges or execute unauthorized operations, ultimately achieving complete control over the Oracle Identity Manager instance including all managed identities and roles.