CVE-2026-60567 Oracle CVE debrief

Who should care

Organizations using Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 should prioritize patching this vulnerability to prevent potential attacks. Affected operators and security teams should review the official advisory and CVE record to validate affected scope, severity, and vendor guidance. Vulnerability management and platform security teams should plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Technical summary

The vulnerability has a CVSS 3.1 Base Score of 9.1, indicating a critical severity level. The CVSS Vector is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), highlighting the vulnerability's high impact on confidentiality and integrity. The affected versions of Oracle Identity Manager are 12.2.1.4.0 and 14.1.2.1.0. The vulnerability is easily exploitable and allows unauthenticated attackers with network access via HTTP to compromise the system.

Defensive priority

High

Recommended defensive actions

• Apply the latest security patches provided by Oracle
• Implement network access controls to restrict access to Oracle Identity Manager
• Monitor system logs for suspicious activity
• Conduct regular vulnerability assessments and penetration testing
• Consider implementing compensating controls, such as Web Application Firewalls (WAFs)
• Review relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-07-21T22:17:56.927Z and last modified on 2026-07-27T13:23:48.383Z. The NVD entry is currently Analyzed. The vulnerability affects Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0. Evidence is based on the official CVE record and NVD entry. Defenders should verify affected product deployments and review official advisories for mitigation guidance.

Official resources