CVE-2026-60560: 
Oracle Identity Manager vulnerability analysis and mitigation

CVE-2026-60560 is a vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware, specifically affecting the REST WebServices component. It affects supported versions 12.2.1.4.0 and 14.1.2.1.0. The vulnerability allows a low-privileged attacker with network access via HTTP to compromise Oracle Identity Manager, resulting in unauthorized access to or modification of critical data. It was published on July 21, 2026, as part of Oracle's Critical Patch Update for July 2026, and carries a CVSS v3.1 base score of 8.1 (High) (Oracle CPU Jul 2026).

The vulnerability resides in the REST WebServices component of Oracle Identity Manager and is described as "easily exploitable" by a low-privileged attacker over the network via HTTP without requiring user interaction. The attack vector is network-based with low attack complexity and low privileges required, indicating that any authenticated user with basic access could trigger the flaw. No specific CWE classification has been publicly disclosed by Oracle, which follows its standard practice of not releasing detailed technical analysis. No public proof-of-concept code or detailed technical write-ups have been identified at this time (Oracle CPU Jul 2026).

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to all Oracle Identity Manager accessible data. The confidentiality and integrity impacts are both rated High, while availability is not affected. Given that Oracle Identity Manager is a core identity governance platform managing user provisioning and access controls, compromise could expose sensitive identity data and enable unauthorized privilege escalation or account manipulation across connected enterprise systems (Oracle CPU Jul 2026).

Oracle has addressed this vulnerability in the July 2026 Critical Patch Update. Administrators should apply the relevant patches for Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 as soon as possible. As a temporary risk reduction measure, Oracle recommends blocking network access to the affected HTTP-based REST WebServices endpoints for users who do not require them, though this is not a permanent fix. Oracle strongly advises against delaying patch application given the ease of exploitation (Oracle CPU Jul 2026).

No notable independent researcher commentary, vendor statements beyond the official advisory, or significant social media discussion specific to CVE-2026-60560 has been identified at this time. The vulnerability was catalogued by VulDB shortly after Oracle's July 2026 CPU publication (VulDB).