External risk intelligence

Oracle Identity Manager OIM Legacy UI Vulnerability Allows Full Takeover

CVE advisorySeverity: CRITICAL (CVSS 9.9)

CVE-2026-60720

Oracle Identity Manager is an enterprise identity and access management solution that is commonly deployed as a web-based, network-accessible service to facilitate user authentication and identity services, making it a common target for network-based interaction.

Missing Authentication

Oracle Identity Manager

12.2.1.4.014.1.2.1.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle Identity Manager, a component within Oracle Fusion Middleware. This issue, easily exploitable by an attacker with network access, could lead to the complete takeover of the Identity Manager system and potentially impact other connected products. The high severity score indicates significant risks to confidentiality, integrity, and availability.

Identity Manager system takeover possible.
Affects critical identity and access management.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by accessing Oracle Identity Manager over the network via HTTP. Due to the vulnerability in the OIM Legacy UI component, a low-privileged attacker can gain control over the Identity Manager system, potentially impacting other connected products. This could lead to a complete takeover of Oracle Identity Manager.

Network access required.
Low-privileged attacker triggers vulnerability.
Risk of Oracle Identity Manager takeover.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect Oracle Identity Manager, potentially allowing a low-privileged attacker with network access to compromise the system. Attacks may significantly impact additional products beyond Oracle Identity Manager itself, leading to a complete takeover of the identity management system and affecting its confidentiality, integrity, and availability.

Oracle Identity Manager system data.
An attacker could exploit network access via HTTP.
Takeover of Oracle Identity Manager.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Oracle Identity Manager component within Oracle Fusion Middleware is the focus of this vulnerability. Given its role in identity and access management, it's likely managed by a combination of application owners, platform teams, and potentially network or security teams. The immediate practical step is to locate all instances of Oracle Identity Manager, determine their network accessibility and business criticality, identify the responsible system owners, and then prioritize remediation based on the assessed risk.

Application and platform teams own the issue.
Verify Oracle Identity Manager network exposure.
Plan remediation by risk and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle Identity Manager and the OIM Legacy UI?

Oracle Identity Manager is a central enterprise software platform within Oracle Fusion Middleware used to manage user identities, access rights, and security policies across an organization. The OIM Legacy UI is a specific web-based interface component of this platform that provides users and administrators with tools to interact with identity management functions. It acts as a gateway for handling user accounts and permissions.

How should I understand the security weakness in CVE-2026-60720?

This vulnerability is a flaw that allows an attacker to bypass standard security controls within the OIM Legacy UI. Because it has a high severity rating, it essentially means the software fails to properly validate or restrict user actions. A successful exploit can lead to a complete system takeover, granting an attacker full control over the identity management processes and the sensitive data handled by the application.

Do I need physical access to trigger this vulnerability?

No, physical access is not required. The vulnerability is triggered remotely over a network connection using the HTTP protocol. It does not require complex or unusual maneuvers; however, it does require the attacker to have at least low-level authenticated access to the network or application interface to initiate the malicious request.

Is my Oracle Identity Manager instance at risk?

If your instance is reachable via a network, Halo Surface Signal identifies this as an external-facing risk. Because this software is designed to facilitate identity services, it is often placed in network-accessible zones, which increases the likelihood of exposure to unauthorized network-based interaction compared to systems isolated from general network traffic.

When should I take action for CVE-2026-60720?

You should prioritize this immediately. Start by identifying all running instances of Oracle Identity Manager and confirming which are accessible via your network. Once you have an inventory, coordinate with your platform and application owners to assess the business impact of these systems and prepare to apply the necessary security updates from the vendor as soon as they are available.

References

www.oracle.com/security-alerts/cspuaug2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.