The CVSS 9.9 assigned to this Oracle Identity Manager vulnerability demands immediate scrutiny against the empirical signal: an EPSS score of 0.00447 indicates roughly 4 in 1,000 exploitation attempts will succeed within 30 days. The disconnect between the headline severity and the low probability metric is not a scoring anomaly — it is a structural feature of how vendor-supplied exploitability language interacts with CVSS 3.1's scoring engine. Oracle describes this as 'easily exploitable' with 'low privilege' access, yet these claims have not translated into observed exploit activity. The EPSS aggregates against this disclosure: automated systems have already processed the exploit availability, patch maturity, and network accessibility factors, and they assign low probability. What the 9.9 score captures is vendor disclosure behavior, not attacker behavior. The 'scope change' language in the vector — indicating attacks may impact additional components — warrants careful interpretation in the IAM context. Oracle Identity Manager functions as an identity broker to downstream systems by design; compromising it provides direct access to federated resources without requiring a second vulnerability. This is not a scoring artifact but an architectural reality. However, historical pattern analysis of Oracle IAM vulnerabilities reveals a consistent lineage: high CVSS scores, frequent scope change language, and vanishingly rare appearances in actual exploitation toolkit discussions or incident post-mortems. The theoretical blast radius exists; the practical realization of that blast radius has not materialized in the documented genealogy of these vulnerabilities. The 'Legacy UI' component qualifier is the most operationally significant detail in this disclosure. This denotes deprecated code — a path being phased out, likely with orphaned security controls, inconsistent authentication enforcement compared to the current interface, and reduced monitoring coverage. Generic exploit infrastructure does not target this specific legacy endpoint, which explains the low EPSS. That same EPSS cannot measure targeted reconnaissance by an actor who knows the old UI exists and understands its different security posture. Organizations running OIM should treat this as a blast radius problem, not a pure probability problem. The 9.9 does not reliably translate to exploitation likelihood, but if compromise occurs, the downstream impact is architectural and severe. Prioritize compensating controls: isolate OIM from non-essential network paths, enforce strict authentication on legacy interfaces specifically, and audit trust relationships to downstream systems. The temporal risk profile matters — a 9.9 that sits unpatched while being deprioritized due to low EPSS accumulates debt as compensating controls degrade over time.
CVE-2026-60720
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedVulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. While the vulnerability is in Oracle Identity Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysisA detailed technical summary for this CVE is being prepared.
CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataThere is no version to upgrade to and no patch to apply. Every affected install stays exposed until the vendor ships a fix — or somebody else builds one.
Free. We build fixes in the order the community asks for them — and we’ll tell you the moment this one lands.
We develop and verify an original fix where the vendor hasn’t, from $5,750. Deployed to your staging first — never straight to production.
Scope it with usSee what else the community needs solved on the solutions-needed board.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2026-60720 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesThe CVSS 9.9 assigned to this Oracle Identity Manager vulnerability demands immediate scrutiny against the empirical signal: an EPSS score of 0.00447 indicates roughly 4 in 1,000 exploitation attempts will succeed within 30 days. The disconnect between the headline severity and the low probability metric is not a scoring anomaly — it is a structural feature of how vendor-supplied exploitability language interacts with CVSS 3.1's scoring engine. Oracle describes this as 'easily exploitable' with 'low privilege' access, yet these claims have not translated into observed exploit activity. The EPSS aggregates against this disclosure: automated systems have already processed the exploit availability, patch maturity, and network accessibility factors, and they assign low probability. What the 9.9 score captures is vendor disclosure behavior, not attacker behavior. The 'scope change' language in the vector — indicating attacks may impact additional components — warrants careful interpretation in the IAM context. Oracle Identity Manager functions as an identity broker to downstream systems by design; compromising it provides direct access to federated resources without requiring a second vulnerability. This is not a scoring artifact but an architectural reality. However, historical pattern analysis of Oracle IAM vulnerabilities reveals a consistent lineage: high CVSS scores, frequent scope change language, and vanishingly rare appearances in actual exploitation toolkit discussions or incident post-mortems. The theoretical blast radius exists; the practical realization of that blast radius has not materialized in the documented genealogy of these vulnerabilities. The 'Legacy UI' component qualifier is the most operationally significant detail in this disclosure. This denotes deprecated code — a path being phased out, likely with orphaned security controls, inconsistent authentication enforcement compared to the current interface, and reduced monitoring coverage. Generic exploit infrastructure does not target this specific legacy endpoint, which explains the low EPSS. That same EPSS cannot measure targeted reconnaissance by an actor who knows the old UI exists and understands its different security posture. Organizations running OIM should treat this as a blast radius problem, not a pure probability problem. The 9.9 does not reliably translate to exploitation likelihood, but if compromise occurs, the downstream impact is architectural and severe. Prioritize compensating controls: isolate OIM from non-essential network paths, enforce strict authentication on legacy interfaces specifically, and audit trust relationships to downstream systems. The temporal risk profile matters — a 9.9 that sits unpatched while being deprioritized due to low EPSS accumulates debt as compensating controls degrade over time.
Practitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2026-60720 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data