What is the CVSS score of CVE-2026-61197?

CVE-2026-61197 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Identity Manager are affected by CVE-2026-61197?

A critical authentication bypass in Oracle Identity Manager (versions 12.2.1.4.0 and 14.1.2.1.0) enables unauthenticated attackers to create, modify, or delete user accounts and access permissions…

How to fix or mitigate CVE-2026-61197?

Within 24 hours, identify and inventory all systems running Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0 and determine whether they have network exposure to untrusted sources. Within 7 days, immediately restrict OIM system access to trusted internal networks only, enforce multi-factor authentication for all administrative access, enable comprehensive audit logging on all identity operations, and escalate to Oracle support to identify any temporary workarounds or hardening guidance available. Within 30 days, work with Oracle to finalize an upgrade plan to a patched version (monitor Oracle Security Advisories for patch availability) and execute the upgrade based on business-criticality windows and downtime tolerance.

Oracle Identity Manager CVE-2026-61197

EUVD-2026-47403 CRITICAL

Improper Access Control (CWE-284)

2026-07-21 secalert_us@oracle.com

GHSA-8v6r-58q9-5mvf

Authentication Bypass Oracle Identity Manager

9.1

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

9.1 CRITICAL

Unauthenticated remote HTTP authentication bypass gives full read/write to identity data (PR:N, AV:N, AC:L, C:H/I:H); no availability impact and no scope change indicated.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:15 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.1

DescriptionCVE.org

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

AnalysisAI

Unauthenticated remote compromise of Oracle Identity Manager (OIM Legacy UI component) in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0 allows attackers with only network/HTTP access to read, create, delete, or modify any data the identity platform can reach. Tagged by the reporter as an authentication bypass, this flaw carries a CVSS 9.1 rating driven by high confidentiality and integrity impact, and because OIM governs enterprise identity and account provisioning, a successful attack effectively hands over control of user identity data. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV.

Technical ContextAI

Oracle Identity Manager is Oracle Fusion Middleware's identity governance and administration platform, responsible for user provisioning, deprovisioning, role management, and access certification across enterprise systems. The affected surface is the 'OIM Legacy UI' component - the older web interface still shipped with supported releases - reachable over HTTP. The reporter's 'Authentication Bypass' tag indicates the root-cause class is a broken or missing authentication check on that legacy interface, meaning requests that should require an authenticated session are instead honored anonymously. No CWE was assigned in the source data, but the behavior is consistent with the CWE-287 (Improper Authentication) / CWE-306 (Missing Authentication for Critical Function) family. Because OIM is a central identity authority, data 'accessible' to it spans account records, entitlements, and potentially credentials for downstream connected systems.

RemediationAI

Apply the fixes delivered in Oracle's July 2026 Critical Patch Update as documented at https://www.oracle.com/security-alerts/cpujul2026.html; this is the primary and vendor-sanctioned remediation for both affected releases (12.2.1.4.0 and 14.1.2.1.0). The input does not list a discrete fixed build number, so treat 'Patch available per vendor advisory' as the patch status and pull the exact patch identifiers directly from the CPU matrix for your OIM version. Until the CPU is applied, reduce exposure of the vulnerable OIM Legacy UI by restricting HTTP access to the OIM console to trusted administrative networks or VPN via firewall/reverse-proxy access-control lists, and where operationally feasible disable or block routes to the Legacy UI component if your deployment uses the newer interface - noting that blocking the legacy endpoints may break administrative workflows or integrations that still depend on them, so validate before enforcing. Increase monitoring of OIM access logs for anonymous or unexpected requests to legacy UI paths as a detective control.