Oracle Identity Manager OIM Legacy UI Remote Takeover Vulnerability

Technical Analysis

CVE-2026-60720 resides in the OIM Legacy UI component of Oracle Identity Manager (versions 12.2.1.4.0 and 14.1.2.1.0), and is remotely exploitable over HTTP with only low privileges and no user interaction required (AV:N/AC:L/PR:L/UI:N). The CVSS 3.1 vector indicates a scope change (S:C) with complete impact to confidentiality, integrity, and availability (C:H/I:H/A:H), meaning a compromised OIM instance could be leveraged to pivot into integrated identity and access management workflows across an enterprise. Because Oracle Identity Manager frequently governs authentication, provisioning, and credential lifecycle for enterprise applications, a full takeover could expose or manipulate service accounts and API credentials used by downstream systems, including automation and orchestration platforms. Organizations that operate AI agents or LLM-based tooling which authenticate through Oracle IAM infrastructure, or that rely on OIM-provisioned service accounts/API keys for RAG pipelines and agent-to-system integrations, face a credential-theft and lateral-movement risk if this vulnerability is exploited, since attacker control of the identity layer could allow issuance or exfiltration of the very credentials agents depend on.

Affected Systems

Oracle Identity Manager (Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.1.0, specifically the OIM Legacy UI component; any downstream systems integrated with OIM for identity and access provisioning.

Indicators of Compromise

• No specific IOCs published; monitor for anomalous HTTP requests to OIM Legacy UI endpoints, unexpected privilege escalations within Oracle Identity Manager, and unusual account provisioning/de-provisioning activity in OIM audit logs.

Remediation Steps

1. 1

   Apply Oracle Critical Patch Update

   Apply the latest Oracle CPU addressing CVE-2026-60720 for Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 as soon as it is released and validated in a test environment.

2. 2

   Restrict network access to OIM Legacy UI

   Limit HTTP access to the OIM Legacy UI component to trusted internal networks and VPN-only access until patched, reducing exposure to low-privileged remote attackers.

3. 3

   Audit low-privilege accounts

   Review and tighten permissions for low-privileged accounts that have network access to OIM, since the vulnerability requires only low privileges to exploit.

4. 4

   Monitor identity and credential activity

   Increase logging and alerting on OIM provisioning, role changes, and credential issuance events, especially for service accounts used by automated systems and AI agent integrations.

5. 5

   Rotate exposed credentials post-incident

   If compromise is suspected, rotate all API keys, service account credentials, and tokens provisioned or managed through OIM, particularly those consumed by agent frameworks and automation pipelines.