CVE-2026-61197: 
Oracle Identity Manager vulnerability analysis and mitigation

CVE-2026-61197 is a critical unauthenticated access vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware, specifically affecting the OIM Legacy UI component. It affects versions 12.2.1.4.0 and 14.1.2.1.0. The vulnerability was disclosed on July 21, 2026, as part of Oracle's Critical Patch Update (CPU) for July 2026. It carries a CVSS v3.1 base score of 9.1 (Critical) (Oracle CPU July 2026, Feedly).

The vulnerability resides in the OIM Legacy UI component of Oracle Identity Manager and is exploitable by unauthenticated attackers over HTTP with no user interaction required (CWE classification not explicitly published, but the attack pattern is consistent with improper access control or missing authentication for critical functions). An attacker with network access can send crafted HTTP requests to unprotected endpoints exposed by the Legacy UI, enabling unauthorized read and write operations against identity management data. No privileges are required, and the attack complexity is low, making this trivially exploitable in network-accessible deployments (Oracle CPU July 2026, Feedly).

Successful exploitation allows an unauthenticated remote attacker to achieve unauthorized creation, deletion, or modification of critical data within Oracle Identity Manager, as well as unauthorized read access to all OIM-accessible data. Because Oracle Identity Manager is a centralized identity and access management platform, compromise can expose user credentials, role assignments, provisioning workflows, and connected system integrations — creating significant risk of lateral movement across enterprise environments. Availability is not directly impacted per the CVSS scoring, but integrity and confidentiality impacts are both rated High (Oracle CPU July 2026, Feedly).

1. Reconnaissance: Identify internet-facing or internally accessible Oracle Identity Manager instances running versions 12.2.1.4.0 or 14.1.2.1.0 using network scanning tools (e.g., Shodan, Censys, Nmap) targeting default OIM HTTP ports.
2. Identify Legacy UI endpoints: Enumerate OIM Legacy UI endpoints (typically accessible via the OIM web application context, e.g., /oim/ or legacy paths) that are exposed without authentication requirements.
3. Craft unauthenticated HTTP requests: Send HTTP requests directly to vulnerable Legacy UI endpoints without supplying authentication credentials, exploiting the missing access control.
4. Exfiltrate or manipulate identity data: Leverage the unauthenticated access to read sensitive identity data (user accounts, roles, entitlements) or perform unauthorized create/delete/modify operations on OIM data objects.
5. Pivot to connected systems: Use harvested credentials, role assignments, or provisioning access to move laterally into systems managed by Oracle Identity Manager (e.g., LDAP directories, enterprise applications, cloud services) (Oracle CPU July 2026, Feedly).

• Network: Unexpected unauthenticated HTTP requests to OIM Legacy UI endpoints from external or unusual source IPs; anomalous HTTP traffic volume targeting OIM web application paths.
• Logs: OIM application logs showing access to Legacy UI resources without associated authenticated session tokens; repeated HTTP 200 responses to sensitive OIM endpoints from unauthenticated sessions.
• Application: Unexpected creation, modification, or deletion of user accounts, roles, or entitlements in Oracle Identity Manager without corresponding authorized change requests; new or modified provisioning policies not initiated by administrators.
• Process/System: Unusual outbound connections from the OIM server to unknown external hosts following access to Legacy UI endpoints.

Oracle has released patches for CVE-2026-61197 as part of the July 2026 Critical Patch Update; administrators should apply the CPU patches for Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 immediately. As a temporary workaround, Oracle recommends blocking network access to the affected HTTP endpoints at the network perimeter or firewall level to reduce exposure until patches can be applied. Oracle strongly advises against treating network-level blocking as a long-term solution, as it does not address the underlying vulnerability. Organizations should also review OIM audit logs for signs of unauthorized access prior to patching (Oracle CPU July 2026).

The vulnerability was catalogued by VulDB shortly after Oracle's disclosure, indicating early community tracking interest (VulDB). No significant vendor statements beyond the Oracle CPU advisory, notable researcher commentary, or broad social media discussion has been identified at this time, consistent with the very recent disclosure date of July 21, 2026.