Oracle Identity Manager CVE-2026-61197

The vulnerable OIM Legacy UI component must be deployed and reachable by the attacker over HTTP - this specific legacy interface is the required attack surface, and organizations that have decommissioned or network-isolated it are not exposed via this vector. Beyond reachability there are no special conditions: per the CVSS vector (AV:N/AC:L/PR:N/UI:N) and the description's 'easily exploitable, unauthenticated' wording, exploitation works against affected default configurations with no credentials, no user interaction, and low complexity. The principal limiting factors are therefore network exposure of the Legacy UI (an attacker must be able to route HTTP to it) and running one of the two affected versions (12.2.1.4.0 or 14.1.2.1.0); anything that restricts HTTP access to the legacy console proportionally limits real-world exploitability.

This is a genuine high-priority issue rather than an inflated high-CVSS score. The CVSS vector AV:N/AC:L/PR:N/UI:N describes the worst practical preconditions: remote, low-complexity, no privileges, and no user interaction, which aligns with the description's 'easily exploitable, unauthenticated' language and the authentication-bypass tag - the signals are internally consistent with no contradictions to flag. Impact is C:H/I:H with A:N, so an attacker gains full read and write to identity data but the scoring does not reflect denial of service. Two data gaps temper certainty: no EPSS exploitation-probability score was provided, and the vulnerability is not in CISA KEV, so there is no evidence of active exploitation. No public exploit code has been identified, meaning current risk is driven by exploitability and blast radius rather than observed attacks; however, unauthenticated identity-management compromise is a high-value target and Oracle CPU vulnerabilities have historically attracted exploit development, so patching should not be deferred.

An attacker who can reach an internet-facing or internal OIM Legacy UI over HTTP sends crafted requests that bypass authentication, then uses the anonymous session to enumerate and modify identity records - for example creating a privileged account or altering entitlements to escalate access across connected systems. Because no authentication, privileges, or user interaction are required (AV:N/AC:L/PR:N/UI:N), the attack can be scripted and repeated; no public proof-of-concept has been identified at time of analysis.