CVE-2026-60722

You are looking at a low-privileged account takeover of Oracle Identity Manager through the Legacy UI component accessed via T3 or IIOP protocols. Versions 12.2.1.4.0 and 14.1.2.1.0 are affected. This is not a sophisticated vulnerability—the attack surface is exactly what the 'easily exploitable' classification suggests: an unprotected protocol handler that speaks Java deserialization and yields full identity system control when fed the right payload. The critical realization here is what OIM compromise actually means. This isn't a content repository where an 8.8 CVSS means 'attacker reads some data.' OIM controls authentication for the entire enterprise. Compromising it means the attacker can impersonate any user, provision or revoke access to any system, and persist through credential rotation because they're operating at the identity layer itself. An attacker with low-privileged network access to the T3/IIOP endpoint effectively has system-level control across every application that trusts OIM for authentication. The blast radius is multiplicative, not additive—cvss understates this structurally. Your immediate actions: verify whether T3/IIOP ports (7001-7005 range typically, but check your topology) are exposed to network segments accessible to low-privilege users, contractors, or compromised endpoints. If they are, treat this as your highest-priority patching cycle despite being in a stable release—OIM at full compromise negates every other security control in your environment. The patch exists, but apply it through a coordinated change window because OIM sits at the integration backbone of your identity infrastructure; a botched patch deployment can break provisioning workflows that other teams depend on. Beyond patching, examine whether your monitoring catches T3/IIOP traffic. These protocols don't register in HTTP logs, WAF alerts, or standard API security scans—the attacker's choice of T3/IIOP over HTTP isn't incidental, it's a deliberate selection of a blind spot in most security architectures. You may need to extend detection coverage to JMX/RMI-style traffic patterns to catch post-exploitation activity. The 'Legacy UI' designation tells you Oracle considers this component maintained for backward compatibility rather than actively developed. That implies the authorization gap likely persists by design to protect existing integrations—meaning closing it cleanly may require coordination with every team that connects to OIM through legacy pathways. Assume this remediation will take longer than a standard patch cycle and plan accordingly.

Reviewed through automated stages and approved by a human before publication.