CVE-2026-35268 is an easily exploitable vulnerability in Oracle Identity Manager (component: Core) affecting versions 12.2.1.4.0 and 14.1.2.1.0. It permits a low privileged attacker with network access via T3 or IIOP protocols to compromise the Identity Manager, potentially resulting in full takeover. The vulnerability also has scope change implications, potentially impacting other Oracle products. The CVSS 3.1 score is 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting critical severity with network attack vector, low attack complexity, and no user interaction required. Oracle’s June 2026 Critical Security Patch Update includes patches for this vulnerability. Oracle strongly recommends applying these patches immediately. Workarounds include blocking network protocols used for exploitation and restricting privileges, though these may disrupt normal operations.

Successful exploitation allows an attacker with low privileges and network access to fully compromise Oracle Identity Manager, leading to complete takeover. This compromises confidentiality, integrity, and availability of the Identity Manager and may affect additional Oracle products due to scope change. The vulnerability poses a critical risk to affected environments.

Oracle has released patches for this vulnerability in the June 2026 Critical Security Patch Update. Customers should apply these security patches without delay to remediate the vulnerability. Until patches are applied, risk can be partially mitigated by blocking network protocols T3 and IIOP used for exploitation and by removing unnecessary privileges or access to relevant packages from users. However, these mitigations may impact application functionality. Oracle strongly recommends staying on actively supported versions and promptly applying security patches as the primary remediation.