This vulnerability affects Oracle Identity Manager's Legacy UI component in versions 12.2.1.4.0 and 14.1.2.1.0. It permits an unauthenticated attacker with network access via T3 or IIOP protocols to exploit the system without needing privileges or user interaction, resulting in complete compromise of Oracle Identity Manager. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is categorized under CWE-306 (Missing Authentication for Critical Function). Oracle's July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly state patch availability or remediation details for it individually. Customers should consult the advisory and apply relevant patches as soon as they become available.

Successful exploitation can lead to full takeover of Oracle Identity Manager, impacting confidentiality, integrity, and availability of the system. This could allow attackers to gain unauthorized access, manipulate identity management functions, and disrupt service operations.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. While the advisory does not explicitly confirm a dedicated patch for CVE-2026-60329, customers are strongly recommended to apply the July 2026 Critical Patch Update promptly and remain on actively supported versions. Patch status is not yet confirmed specifically for this vulnerability; therefore, customers should monitor Oracle's advisory for updates and apply patches as they become available.