CVE-2026-60567: 
Oracle Identity Manager vulnerability analysis and mitigation

CVE-2026-60567 is a critical vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware, specifically affecting the OIM Legacy UI component. It affects versions 12.2.1.4.0 and 14.1.2.1.0. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager, resulting in unauthorized access to and modification of critical data. It carries a CVSS v3.1 base score of 9.1 (Critical) (Oracle CPU Jul 2026, EUVD).

The vulnerability resides in the OIM Legacy UI component of Oracle Identity Manager and is classified as easily exploitable with no authentication, no user interaction, and low attack complexity required (CWE details not explicitly published by Oracle). The attack vector is network-based over HTTP, meaning any attacker with network access to the affected system can attempt exploitation without needing credentials or special privileges. Oracle does not publicly disclose detailed technical analysis of the vulnerability mechanics, but the impact on both confidentiality and integrity — with no availability impact — suggests the flaw may involve improper access control or authentication bypass in the legacy UI layer (Oracle CPU Jul 2026).

Successful exploitation allows an unauthenticated remote attacker to achieve unauthorized creation, deletion, or modification of critical data within Oracle Identity Manager, as well as unauthorized read access to all OIM-accessible data. Because Oracle Identity Manager is a privileged identity governance platform managing user accounts, roles, and access policies across enterprise systems, a compromise could enable an attacker to escalate privileges, provision rogue accounts, or exfiltrate sensitive identity and access data across connected systems. There is no reported availability impact (Oracle CPU Jul 2026).

Oracle has addressed this vulnerability as part of the July 2026 Critical Patch Update (CPU). Affected organizations should apply the relevant patches for Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 immediately. As a temporary risk reduction measure, Oracle recommends blocking network access to the affected HTTP-based service from untrusted networks, though this is not a permanent fix. Oracle strongly advises against delaying patch application given the unauthenticated, network-exploitable nature of this vulnerability (Oracle CPU Jul 2026).