PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-61118 Oracle CVE debrief

The CVE-2026-61118 vulnerability is an easily exploitable issue in the Oracle Identity Manager product of Oracle Fusion Middleware, specifically in the OIM Legacy UI component. This vulnerability allows low-privileged attackers with network access via HTTP to compromise Oracle Identity Manager, potentially leading to system takeover. The CVE record was published on 2026-08-18T21:16:54.177Z and has not been modified since then. Administrators and users of affected versions 12.2.1.4.0 and 14.1.2.1.0 should review and apply Oracle's security patches to prevent potential takeover of the system. The CVSS score of 8.8 indicates high confidentiality, integrity, and availability impacts. To verify the inventory of Oracle Identity Manager systems and ensure they are up-to-date with the latest security patches, operators, platform administrators, vulnerability management teams, and security teams should take necessary actions. Evidence-based verification tasks and defensive measures are recommended to mitigate this vulnerability.

Vendor
Oracle
Product
Identity Manager
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-18
Original CVE updated
2026-08-21
Advisory published
2026-08-18
Advisory updated
2026-08-21

Who should care

Administrators and users of Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 should review and apply Oracle's security patches to prevent potential takeover of the system. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure the system is secure and up-to-date.

Technical summary

The CVE-2026-61118 vulnerability is an easily exploitable vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. The vulnerability affects Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0, with a CVSS score of 8.8, indicating high confidentiality, integrity, and availability impacts. This vulnerability allows low-privileged attackers with network access via HTTP to compromise Oracle Identity Manager. To address this issue, administrators should verify the inventory of Oracle Identity Manager systems and ensure they are up-to-date with the latest security patches. Defensive measures, such as restricting network access and monitoring systems for suspicious activity, are also recommended.

Defensive priority

Oracle Identity Manager vulnerability with high CVSS score of 8.8, allowing low-privileged attackers to compromise the system.

Recommended defensive actions

  • Review and apply Oracle's security patches for Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0.
  • Restrict network access to Oracle Identity Manager to only necessary personnel.
  • Monitor Oracle Identity Manager systems for suspicious activity.
  • Implement compensating controls, such as multi-factor authentication, for Oracle Identity Manager users.
  • Verify inventory of Oracle Identity Manager systems and ensure they are up-to-date with the latest security patches.
  • Track exceptions and retest remediated assets.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE-2026-61118 vulnerability affects Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0, with a CVSS score of 8.8, indicating high confidentiality, integrity, and availability impacts. This vulnerability is an easily exploitable issue in the OIM Legacy UI component of Oracle Fusion Middleware. Successful attacks can result in the takeover of Oracle Identity Manager. Administrators should verify the inventory of Oracle Identity Manager systems and ensure they are up-to-date with the latest security patches. The CVE record was published on 2026-08-18T21:16:54.177Z and has not been modified since then.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-18T21:16:54.177Z and has not been modified since then.