Oracle Identity Manager Unauthenticated Remote Takeover Vulnerability (CVE-2026-60721)
First seen Aug 20, 2026 · Updated Aug 20, 2026 · CVSS 9.8
A critical unauthenticated remote vulnerability affects Oracle Identity Manager's Legacy UI component within Oracle Fusion Middleware, allowing full compromise via simple HTTP requests. With a CVSS score of 9.8, this flaw requires no authentication or user interaction, making it highly attractive for mass exploitation once technical details or proof-of-concept code emerge. Organizations running affected versions face risk of complete identity infrastructure takeover, including provisioning, credential, and access control data.
Technical Analysis
CVE-2026-60721 resides in the OIM Legacy UI component of Oracle Identity Manager (versions 12.2.1.4.0 and 14.1.2.1.0), and is exploitable by an unauthenticated attacker over HTTP with low attack complexity (AV:N/AC:L/PR:N/UI:N). Successful exploitation yields high impact to confidentiality, integrity, and availability, effectively enabling full application-level takeover of the identity management system. Given OIM's role as a central identity provisioning and access-governance platform, compromise could allow attackers to create rogue accounts, escalate privileges, or exfiltrate credential and entitlement data used across integrated enterprise systems. Because Oracle Identity Manager is frequently integrated with SSO, directory services, and API/token issuance systems that AI agents and automation pipelines rely on for authentication and authorization, a breach here could expose or forge credentials and access tokens consumed by agentic systems, enabling downstream agent impersonation or unauthorized tool/API access.
Affected Systems
Oracle Identity Manager (Oracle Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.1.0, specifically the OIM Legacy UI component exposed via HTTP.
Indicators of Compromise
- No specific IOCs published at this time (vulnerability disclosure stage; monitor Oracle Critical Patch Update advisories and exploit-detection signatures for OIM Legacy UI endpoints).
Remediation Steps
- 1
Apply Oracle Critical Patch Update
Apply the official Oracle patch addressing CVE-2026-60721 for Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 as soon as it is released; prioritize this due to the 9.8 CVSS score and unauthenticated network attack vector.
- 2
Restrict network access to OIM Legacy UI
Limit or block external/unauthenticated HTTP access to the Legacy UI component using firewall rules, WAF policies, or network segmentation until patching is complete.
- 3
Monitor for exploitation attempts
Deploy detection rules for anomalous HTTP requests targeting OIM Legacy UI endpoints and monitor identity provisioning logs for unauthorized account creation or privilege changes.
- 4
Rotate credentials and tokens tied to OIM
Rotate service account credentials, API keys, and tokens managed or issued through Oracle Identity Manager, especially those consumed by automation, RAG pipelines, or AI agent frameworks, in case of prior compromise.
- 5
Audit identity and access configurations
Review OIM provisioning rules, role assignments, and integration points with downstream systems (SSO, directory services, agent orchestration platforms) for signs of tampering.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.