Oracle disclosed a critical, easily exploitable flaw in Oracle Identity Manager's Legacy UI component that lets a low-privileged network attacker take over the identity platform entirely.
What Is It
CVE-2026-61066 is a vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware, specifically the OIM Legacy UI component. Oracle describes it as an easily exploitable vulnerability that allows a low-privileged attacker with network access via RMI to compromise Oracle Identity Manager. Successful attacks result in complete takeover of Oracle Identity Manager.
It carries a CVSS 3.1 base score of 9.9 (CRITICAL), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, network attack vector, low complexity, low privileges required, no user interaction, and full confidentiality, integrity, and availability impact.
Why It Matters
The scope is marked as changed, and Oracle explicitly notes that while the vulnerability lives in Oracle Identity Manager, attacks may significantly impact additional products. That matters more than usual here: Oracle Identity Manager is an identity and access management platform, so compromise of the platform plausibly extends beyond the application itself. How far it extends depends on the specific deployment; what systems the OIM instance provisions, what credentials and connectors it holds, and what trust downstream applications place in it. Neither Oracle's advisory nor the NVD record enumerates the affected downstream products, so the practical blast radius has to be assessed per environment rather than assumed.
The combination of low attack complexity, no user interaction, and only low privileges required puts this within reach of any attacker who already holds a minimal foothold or low-tier account with RMI reachability.
CVE-2026-61066 does not appear in CISA's Known Exploited Vulnerabilities catalog as of this writing, so active exploitation is not confirmed at this time. That status can change; the catalog is the authoritative place to re-check.
What's Vulnerable
- Vendor: Oracle Corporation
- Product: Oracle Identity Manager (Oracle Fusion Middleware)
- Component: OIM Legacy UI
- Affected versions: 12.2.1.4.0 and 14.1.2.1.0
- Attack path: Network access via RMI
Patch Status
The CVE was published 2026-08-18 and its NVD status is Received, meaning the record is still awaiting full analysis. The sole vendor reference in the record points to an Oracle Critical Patch Update advisory URL bearing an August 2026 label. Oracle ships Critical Patch Updates on a fixed quarterly schedule, January, April, July, and October, so there is no regular August CPU, and that reference should be treated as provisional until it resolves. Administrators running the affected 12.2.1.4.0 or 14.1.2.1.0 builds should check the July 2026 CPU for an existing fix and the October 2026 CPU for one still pending, using Oracle's security alerts index as the entry point rather than relying on the linked URL alone. No specific required-action deadline is present in the supplied data. In the meantime, restrict RMI exposure on affected instances to trusted networks.
Sources
- Oracle Critical Patch Update advisory (as referenced in the CVE record), https://www.oracle.com/security-alerts/cpuaug2026.html
- NVD, CVE-2026-61066, https://nvd.nist.gov/vuln/detail/CVE-2026-61066
- CISA Known Exploited Vulnerabilities Catalog; https://www.cisa.gov/known-exploited-vulnerabilities-catalog