External risk intelligence

Oracle Identity Manager OIM Legacy UI Takeover Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-60721

Oracle Identity Manager is an identity and access management portal typically designed to be reachable via web interfaces. As an identity portal that allows unauthenticated network access via HTTP, it is inherently intended to face network environments to facilitate user authentication and management functions.

Missing Authentication

Oracle Identity Manager

12.2.1.4.014.1.2.1.0

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Oracle Identity Manager, a component of Oracle Fusion Middleware. This issue, which can be exploited remotely over HTTP without authentication, could allow an attacker to gain full control of the Identity Manager system, impacting confidentiality, integrity, and availability. The primary concern at this time is to confirm if our environment is affected and to what extent.

Unauthenticated access can lead to full system takeover.
Critical access control system at risk of compromise.
Confirm relevance and exposure of Identity Manager.

Attack Path

How an attacker could exploit the issue

An attacker could target Oracle Identity Manager by accessing it over the network. Since this vulnerability doesn't require authentication or any user interaction, an unauthenticated attacker could exploit it remotely through HTTP to gain complete control of the system.

Network access required, no authentication.
Exploitable via HTTP.
Leads to full system takeover.

Live Threat

Current exploitation, exposure, and threat context

A critical vulnerability in Oracle Identity Manager could allow an unauthenticated attacker with network access to compromise the entire system. This means an attacker could potentially gain complete control over the identity and access management functions supported by Oracle Identity Manager, impacting confidentiality, integrity, and availability.

Identity and access management data.
Network access via HTTP.
Takeover of Oracle Identity Manager.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Oracle Identity Manager product is likely managed by platform or application teams responsible for identity and access management, with network and security teams ensuring its external accessibility and protection. The first critical step is to locate all instances of Oracle Identity Manager, assess their network exposure, and identify the business-criticality and accountable owner for each.

Platform and application owners should lead remediation.
Verify network exposure and business criticality first.
Plan coordinated updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Oracle Identity Manager and what does the OIM Legacy UI do?

Oracle Identity Manager is a core component of Oracle Fusion Middleware used for centralized identity and access management. It allows organizations to manage user lifecycles, permissions, and credentials across applications. The OIM Legacy UI component provides the web-based interface that administrators and users interact with to perform these identity-related tasks.

What is the nature of the weakness in CVE-2026-60721?

CVE-2026-60721 represents a critical security flaw that allows an attacker to bypass authentication mechanisms. By targeting the OIM Legacy UI, an unauthorized party can gain full control over the application. This type of vulnerability typically involves improper access control, where the system fails to verify the identity of the requester, resulting in unauthorized administrative-level access.

How does an attacker trigger CVE-2026-60721?

An attacker triggers this vulnerability by sending specially crafted HTTP requests to the Oracle Identity Manager instance over a network. Because the system does not require authentication, the attacker does not need legitimate credentials or any interaction from a system user to successfully exploit the flaw and seize control of the application.

Why is this CVE high-risk for my organization?

According to Halo Surface Signal, Oracle Identity Manager is often intentionally deployed to be reachable via web interfaces to handle user authentication. If your instance is accessible over the network, it is at high risk because this flaw allows remote, unauthenticated takeover of a system that manages your organization's sensitive identity and access data.

What should I do first to address this vulnerability?

Begin by creating a comprehensive inventory of all Oracle Identity Manager instances within your environment. Verify which instances are accessible over the network and identify the specific business owners responsible for those systems. Once mapped, coordinate with your platform and security teams to prioritize these assets for scheduled maintenance and updates.

References

www.oracle.com/security-alerts/cspuaug2026.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.