CVE-2026-61066: 
Oracle Identity Manager vulnerability analysis and mitigation

CVE-2026-61066 is an Improper Access Control vulnerability (CWE-284) in the OIM Legacy UI component of Oracle Identity Manager, part of Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.1.0. The vulnerability was published on August 18, 2026, and addressed in Oracle's August 2026 Critical Security Patch Update (CSPU). It carries a CVSS v3.1 base score of 9.9 (Critical), reflecting its network-accessible, low-complexity, low-privilege attack vector with a changed scope (Oracle CSPU Aug 2026, Feedly).

The vulnerability is classified as Improper Access Control (CWE-284) within the OIM Legacy UI component of Oracle Identity Manager. Exploitation occurs over the RMI (Remote Method Invocation) protocol, requiring only low-level network privileges — no user interaction is needed and attack complexity is low. The scope is marked as "Changed," indicating that a successful attack can extend beyond Oracle Identity Manager itself to impact additional connected products or systems. No detailed public technical write-ups or proof-of-concept code have been identified at this time (Oracle CSPU Aug 2026, Feedly).

Successful exploitation allows a low-privileged remote attacker to achieve complete takeover of Oracle Identity Manager, with high impact to confidentiality, integrity, and availability. Because Oracle Identity Manager is a centralized identity and access management platform, compromise can expose sensitive user credentials, role assignments, and provisioning data across all connected enterprise systems. The changed scope means attacks may propagate to additional integrated products, significantly amplifying the blast radius beyond the initial target (Oracle CSPU Aug 2026, Feedly).

As of the time of publication, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.36%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. NVD's SSVC assessment classifies exploitation as "none" and automation as "no," suggesting that while the vulnerability is severe, active weaponization has not yet been observed (Feedly).

1. Reconnaissance: Identify Oracle Identity Manager instances running versions 12.2.1.4.0 or 14.1.2.1.0 exposed on the network, using network scanning tools (e.g., Shodan, Nmap) to locate open RMI ports (typically TCP 1099 or custom configured ports).
2. Obtain low-privileged credentials: Acquire any valid low-privileged account on the Oracle Identity Manager instance, which may be obtained through phishing, credential stuffing, or default credentials.
3. Connect via RMI: Use an RMI client or custom tooling to connect to the Oracle Identity Manager RMI endpoint exposed by the OIM Legacy UI component.
4. Exploit improper access control: Invoke RMI methods or objects that are insufficiently access-controlled, leveraging the CWE-284 weakness to perform actions beyond the attacker's intended privilege level.
5. Achieve system takeover: Leverage the unauthorized access to read sensitive identity data, modify configurations, provision rogue accounts, or disrupt service availability — potentially pivoting to connected systems due to the changed scope (Oracle CSPU Aug 2026, Feedly).

• Network: Unexpected or anomalous RMI connections (TCP port 1099 or configured OIM RMI port) from unauthorized source IPs to Oracle Identity Manager servers; unusual outbound connections from the OIM server to unknown external hosts.
• Logs: Oracle Identity Manager audit logs showing privilege escalation events, unauthorized role or policy modifications, or unexpected administrative actions by low-privileged accounts; RMI access logs showing connections from atypical client addresses.
• File System: Unexpected new user accounts or role assignments created in the OIM database; unauthorized changes to provisioning workflows or system configurations.
• Process: Unusual Java processes spawned by the OIM application server; unexpected connections from the OIM JVM process to external or internal systems not part of normal operations (Feedly).

Oracle has released a patch for CVE-2026-61066 as part of the August 2026 Critical Security Patch Update (CSPU), and organizations should apply it immediately for affected versions 12.2.1.4.0 and 14.1.2.1.0. As a temporary workaround prior to patching, Oracle recommends restricting network access to the RMI port used by Oracle Identity Manager to only authorized administrators and systems. Additionally, organizations should review and minimize the number of low-privileged accounts with network access to OIM, and monitor RMI traffic for suspicious activity. Oracle strongly advises against relying on network-level controls as a long-term solution (Oracle CSPU Aug 2026).

The vulnerability was noted on Bluesky by security community accounts shortly after disclosure, and it appeared in Rapid7's vulnerability database listing. No major vendor statements beyond Oracle's advisory or significant researcher commentary have been identified at this time (Feedly).