CVE-2026-46810 is a vulnerability in Oracle Fusion Middleware Identity Manager's End User Self Service component affecting versions 12.2.1.4.0 and 14.1.2.1.0. It allows an unauthenticated attacker with network access via the IIOP protocol to compromise the Identity Manager, resulting in unauthorized read and write (update, insert, delete) access to some accessible data. The CVSS 3.1 base score is 6.5, reflecting low complexity and no required privileges or user interaction. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which includes targeted security fixes for Identity Manager and other products. The vendor strongly recommends applying the patches without delay to prevent exploitation.

Successful exploitation allows an unauthenticated attacker to gain unauthorized read access to some data and unauthorized update, insert, or delete access to some Identity Manager accessible data, impacting confidentiality and integrity. There is no impact on availability. This could lead to data compromise or unauthorized data manipulation within the affected Oracle Identity Manager installations.

Oracle has released patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers should apply these patches promptly to remediate the issue. Until patches are applied, risk may be reduced by blocking network protocols required for exploitation (such as IIOP) or by restricting privileges and access to relevant packages for users who do not need them, though these measures may disrupt application functionality. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory.