CVE-2026-61118: 
Oracle Identity Manager vulnerability analysis and mitigation

CVE-2026-61118 is an improper access control vulnerability in the Oracle Identity Manager (OIM) Legacy UI component of Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.1.0 and allows a low-privileged attacker with network access via HTTP to fully compromise the Oracle Identity Manager system. The vulnerability was disclosed on August 18, 2026, with a patch released as part of Oracle's Critical Security Patch Update (CSPU) for August 2026. It carries a CVSS v3.1 base score of 8.8 (High) (Oracle CSPU Aug 2026).

The vulnerability is classified as CWE-284 (Improper Access Control), meaning the OIM Legacy UI component fails to properly enforce access restrictions for authenticated low-privileged users. An attacker with a valid low-privilege account can send crafted HTTP requests to the Legacy UI component to escalate privileges or otherwise bypass authorization controls, ultimately achieving full system takeover. No user interaction is required, and attack complexity is low, making this straightforward to exploit once an attacker has any valid credentials. No public technical write-ups or proof-of-concept code have been identified at this time (Oracle CSPU Aug 2026, Feedly).

Successful exploitation results in a complete takeover of Oracle Identity Manager, with high impact to confidentiality, integrity, and availability. An attacker can read sensitive identity and access management data, modify system configurations and user provisioning data, and disrupt service availability. Given that Oracle Identity Manager is a central identity governance platform, compromise could enable lateral movement across enterprise systems by manipulating user accounts, roles, and access policies (Oracle CSPU Aug 2026).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.447%, indicating a low but non-negligible probability of exploitation in the near term. The NVD SSVC assessment notes the technical impact is "total" but exploitation is currently rated as "none" (Oracle CSPU Aug 2026).

1. Reconnaissance: Identify Oracle Identity Manager instances exposed over HTTP/HTTPS using network scanning tools or Shodan, targeting versions 12.2.1.4.0 or 14.1.2.1.0.
2. Obtain low-privilege credentials: Acquire any valid low-privileged OIM user account through phishing, credential stuffing, or other means — no elevated privileges are required.
3. Access the Legacy UI component: Authenticate to the OIM Legacy UI via HTTP using the low-privilege account.
4. Exploit improper access control: Send crafted HTTP requests to restricted Legacy UI endpoints that fail to enforce proper authorization checks, bypassing privilege boundaries.
5. Achieve system takeover: Leverage the access control bypass to perform administrative actions, such as modifying user roles, provisioning accounts, or executing privileged operations, resulting in full compromise of the Oracle Identity Manager instance (Oracle CSPU Aug 2026).

• Network: Unusual HTTP requests from low-privileged user accounts to administrative or restricted Legacy UI endpoints in Oracle Identity Manager; unexpected outbound connections from the OIM server.
• Logs: OIM audit logs showing low-privileged accounts accessing administrative functions or performing privilege-escalated operations; repeated access attempts to restricted Legacy UI paths.
• Application: Unexpected changes to user roles, entitlements, or provisioning policies within Oracle Identity Manager; new administrative accounts created without proper change management records.
• Authentication: Low-privileged accounts performing actions typically reserved for administrators, such as modifying system configurations or bulk user provisioning.

Oracle has released a patch for CVE-2026-61118 as part of the August 2026 Critical Security Patch Update (CSPU). Administrators should apply the patch immediately for affected versions 12.2.1.4.0 and 14.1.2.1.0. As interim mitigations, Oracle recommends restricting network access to the OIM Legacy UI to authorized users and systems only, implementing network segmentation to limit exposure of the HTTP interface, and monitoring for suspicious authentication activity from low-privileged accounts. Oracle strongly advises against relying on network-level workarounds as a long-term solution (Oracle CSPU Aug 2026).

The vulnerability was noted in aggregated vulnerability tracking resources such as VulDB and CyberHub Blog shortly after disclosure. No significant independent researcher commentary, vendor statements beyond the official Oracle advisory, or notable media coverage has been identified at this time.