CVE-2026-91501 is a vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0. It allows a low privileged attacker with logon access to the infrastructure where Oracle Identity Manager runs to compromise the system. The vulnerability can lead to unauthorized access to critical data or complete access to all data accessible by Oracle Identity Manager. The CVSS 3.1 base score is 5.5, indicating a medium severity with high confidentiality impact but no integrity or availability impact.
CVE-2026-91407 is a high-severity vulnerability in Oracle Identity Manager (part of Oracle Fusion Middleware) affecting versions 12.2.1.4.0 and 14.1.2.1.0. It allows a low privileged attacker with network access via HTTP to fully compromise the product, impacting confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 base score of 8.8. Oracle has published a Critical Patch Update advisory addressing this and many other vulnerabilities, recommending prompt patch application.
CVE-2026-91259 is a high-severity vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially resulting in full takeover. The vulnerability affects confidentiality, integrity, and availability with a CVSS 3.1 base score of 8.8. Oracle has published a Critical Patch Update advisory including patches for this and many other vulnerabilities.
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-73943 is a vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 that allows a high privileged attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized access to critical data and unauthorized modification (update, insert, delete) of some data accessible by Oracle Identity Manager. The vulnerability impacts confidentiality and integrity but not availability. It has a CVSS 3.1 base score of 7.6, indicating high severity. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update advisory, which provides patches for affected products including Oracle Identity Manager.
CVE-2026-73942 is a high-severity vulnerability in Oracle Identity Manager (OIM Legacy UI component) versions 12.2.1.4.0 and 14.1.2.1.0. It allows a low privileged attacker with network access via HTTP to compromise the system, potentially leading to full takeover of Oracle Identity Manager. The vulnerability has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides patches for affected products including Oracle Identity Manager. Customers are strongly advised to apply the available patches promptly to mitigate the risk.
CVE-2026-70915 is a high-severity vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0. It allows a low privileged attacker with network access via T3 or IIOP protocols to compromise the product, potentially leading to full takeover. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 8.8. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update (CSPU).
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-61118 is a high-severity vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to complete takeover. The vulnerability affects confidentiality, integrity, and availability with a CVSS 3.1 base score of 8.8. Oracle has included fixes for this vulnerability in its August 2026 Critical Security Patch Update.
CVE-2026-61066 is a critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0. It allows a low privileged attacker with network access via RMI to compromise Oracle Identity Manager, potentially leading to full takeover. The vulnerability impacts confidentiality, integrity, and availability with a CVSS score of 9.9. Oracle has issued a Critical Security Patch Update addressing this and many other vulnerabilities. Customers are strongly advised to apply the available patches promptly.
CVE-2026-60722 is a high-severity vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0. It allows a low privileged attacker with network access via T3 or IIOP protocols to compromise the product, potentially leading to full takeover. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 8.8. Oracle has released a Critical Security Patch Update addressing this and many other vulnerabilities. Customers are strongly advised to apply the official patches promptly.
CVE-2026-60721 is a critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0. It allows an unauthenticated attacker with network access via HTTP to compromise the product, potentially resulting in full takeover. The vulnerability affects the OIM Legacy UI component and has a CVSS 3.1 base score of 9.8, indicating high impact on confidentiality, integrity, and availability.
CVE-2026-60720 is a critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0. It allows a low privileged attacker with network access via HTTP to fully compromise Oracle Identity Manager, potentially impacting additional Oracle products. The vulnerability affects confidentiality, integrity, and availability, with a CVSS 3.1 base score of 9.9. Oracle has released a Critical Security Patch Update addressing this and many other vulnerabilities.
CVE-2026-60716 is a high-severity vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0. It allows a low privileged attacker with network access via T3 or IIOP protocols to compromise the product, potentially resulting in full takeover. The vulnerability affects the OIM Legacy UI component and has a CVSS 3.1 base score of 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has included this fix in its August 2026 Critical Security Patch Update.
CVE-2026-60715 is a high-severity vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially leading to full takeover. The vulnerability affects confidentiality, integrity, and availability with a CVSS 3.1 base score of 8.8. Oracle has included this vulnerability in its August 2026 Critical Security Patch Update, which provides patches for affected versions.
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).