CVE-2026-60716

The 'Legacy UI' label attached to this Oracle Identity Manager vulnerability is the detail that deserves your attention, and it's easy to overlook. In Oracle's terminology, 'Legacy' marks a deprecated interface layer maintained for backward compatibility — code built on older frameworks that predates current secure development practices and hasn't received the same security engineering investment as actively-developed paths. This isn't speculation; it's how Oracle has historically handled its product line, and it's why this CVE warrants more scrutiny than its CVSS 8.8 score suggests. The exploitation vector amplifies the concern. This flaw is reachable over T3 and IIOP — Oracle WebLogic's native protocols, not standard HTTP traffic that your perimeter sensors are tuned to inspect. Detection rules looking for anomalous web requests will miss this entirely. More critically, T3/IIOP communication indicates the attacker already has network adjacency to the Oracle middleware layer, which narrows your threat model significantly: this isn't an external web attacker, it's someone with access to an internal network segment. The low-privileged attacker requirement is deceptively significant. In OIM environments, 'low privilege' still means the ability to interact with provisioning workflows, access requests, and certification processes — all of which operate within sensitive identity data and organizational trust relationships. Gaining OIM takeover from that position means the attacker has already subverted the authorization boundaries that should prevent escalation, which is precisely what identity-centric attack chains are designed to exploit. For detection, focus your hunting on WebLogic logs for unusual T3/IIOP connection patterns and payload sizes, particularly from endpoints that shouldn't be speaking those protocols. For remediation, Oracle middleware patches require regression testing against downstream integrations (HR systems, ERP connectors), and enterprise patch cycles for OIM stacks routinely run 60-180 days. Treat this CVE publication as the start of your exposure window, not the end of it.

Reviewed through automated stages and approved by a human before publication.