This vulnerability affects Oracle Identity Manager's Legacy UI component in versions 12.2.1.4.0 and 14.1.2.1.0. It is exploitable over the network via HTTP by an attacker with low privileges and no user interaction required. The attacker can gain unauthorized capabilities to create, delete, or modify critical data or access all data within Oracle Identity Manager. The CVSS vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impacts. The vendor advisory from Oracle's July 2026 Critical Patch Update references this vulnerability but does not explicitly confirm patch availability or remediation status for it individually. The advisory strongly recommends applying security patches without delay to mitigate such vulnerabilities.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data or complete access to all data accessible by Oracle Identity Manager. This compromises confidentiality and integrity of sensitive information managed by the product. Availability is not impacted according to the CVSS vector. The vulnerability allows a low privileged attacker with network access to escalate their privileges and compromise the system's data integrity and confidentiality.

Oracle's July 2026 Critical Patch Update advisory includes security patches addressing multiple vulnerabilities including this one. Although no specific patch or remediation level is explicitly stated for CVE-2026-60323, Oracle strongly recommends that customers remain on actively supported versions and apply all available security patches promptly. Users should review the advisory at https://www.oracle.com/security-alerts/cpujul2026.html for detailed patch availability and installation instructions. Patch status is not yet confirmed specifically for this vulnerability; therefore, checking the vendor advisory for current remediation guidance is essential.