CVE-2026-60715

CVE-2026-60715 in Oracle Identity Manager's Legacy UI is a network-exploitable privilege escalation affecting versions 12.2.1.4.0 and 14.1.2.1.0. The CVSS 8.8 (AV:N/AC:L/PR:L) tells you the attacker needs only low-level credentials and no user interaction — this isn't a trust bypass, it's a missing guard. The Legacy UI was never updated to the current authorization model while everything around it was hardened, leaving an unmapped code path that still processes authenticated requests. What makes this urgent isn't the CVSS number — it's OIM's position in your authorization topology. Compromising OIM doesn't just give you the application; it gives you the identity substrate everything else authenticates against. Every system OIM provisions, deprovisions, or federates with becomes a potential pivot point. HR systems, cloud directories, Active Directory, provisioning connectors — they all trust OIM as authoritative. Here's what to check: first, identify whether you have other OIM components that were explicitly exempted from hardening work due to backwards-compatibility requirements or API dependencies — those are your equivalent Legacy UIs. Second, audit your integration topology: which components can't you refactor because too many downstream systems depend on them? Those dependency relationships are exactly why Oracle couldn't remove this UI, and they're exactly why attackers target identity systems — the blast radius is structural, not coincidental. The patch window matters. IAM teams often deprioritize UI-layer updates because they're perceived as lower risk than core provisioning services. That organizational inertia compounds the exposure. When you patch this, plan for integration testing with downstream consumers — the same dependency graph that kept this vulnerability alive will constrain your remediation.

Reviewed through automated stages and approved by a human before publication.