CVE-2026-46807 is a critical security vulnerability in Oracle Fusion Middleware's Identity Manager product, specifically in the OIM Legacy UI component. It affects versions 12.2.1.4.0 and 14.1.2.1.0. The flaw allows an unauthenticated attacker with network access via T3 and IIOP protocols to compromise the Identity Manager, potentially resulting in full system takeover. The vulnerability has a CVSS 3.1 score of 9.8 with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality, integrity, and availability at a high level. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes targeted security patches for affected products. Oracle strongly recommends applying these patches without delay. As a temporary mitigation, blocking the T3 and IIOP protocols or restricting unnecessary privileges can reduce exposure, though these may affect application functionality.

Successful exploitation of this vulnerability allows an unauthenticated attacker with network access to the T3 or IIOP protocols to fully compromise Oracle Identity Manager. This results in complete loss of confidentiality, integrity, and availability of the Identity Manager system, effectively enabling an attacker to take over the system.

Oracle has released security patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers should apply these patches promptly to remediate the vulnerability. Until patches are applied, risk can be mitigated by blocking network access to the T3 and IIOP protocols or by removing unnecessary privileges and access to relevant packages for users. However, these mitigations may disrupt normal application functionality. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay.