EXPOSURES › CVE-2026-61066
CVE-2026-61066
CRITICALA critical RMI-based vulnerability in Oracle Identity Manager allows low-privileged attackers to take over the system.
CVE-2026-61066 affects Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0, enabling remote compromise via RMI without user interaction. DIB organizations must patch immediately as this represents a high-severity, avoidable exposure that could lead to full system takeover and data loss.
Shame score — A critical, easily exploitable vulnerability in a widely deployed identity management product that allows remote takeover without user interaction.
▸ RECOMMENDED ACTION Remote code execution — patch the affected products on priority.
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via RMI to compromise Oracle Identity Manager. While the vulnerability is in Oracle Identity Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
| PRODUCT | STATUS |
|---|---|
| Aconex for Defense Oracle |
Authorized |
| Federal Managed Cloud Services Oracle |
Authorized |
| Fusion Cloud Oracle |
Authorized |
| Government Cloud - Common Controls Oracle |
Authorized |
| Oracle Cloud Infrastructure-Government Cloud Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) Oracle |
Authorized |
| Oracle Enterprise Performance Management (EPM) - Moderate Oracle |
In Process |
| Oracle Service Cloud Oracle |
Authorized |
| Oracle Service Cloud (DOD) Oracle |
Authorized |
| Taleo Cloud - U.S. Government Cloud Oracle |
Authorized |