A high-severity vulnerability exists in Oracle Identity Manager (OIM) Legacy UI component, affecting versions 12.2.1.4.0 and 14.1.2.1.0. This vulnerability allows a low-privileged attacker with network access via HTTP to potentially take over the Oracle Identity Manager. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has released security patches addressing this vulnerability as part of its September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk.
A vulnerability exists in the Oracle Identity Manager product of Oracle Fusion Middleware, specifically in the OIM Legacy UI component. It affects versions 12.2.1.4.0 and 14.1.2.1.0. The flaw allows a high privileged attacker with network access via HTTP to compromise Oracle Identity Manager, potentially resulting in unauthorized access to critical data and unauthorized modification of some data. The vulnerability has a CVSS 3.1 base score of 7.6, indicating high severity with significant confidentiality and integrity impacts. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.
CVE-2026-46810 is a medium severity vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0. It allows an unauthenticated attacker with network access via IIOP to perform unauthorized read, update, insert, or delete operations on some accessible data. The vulnerability impacts confidentiality and integrity but not availability. Oracle has included this vulnerability in its June 2026 Critical Security Patch Update, which provides patches for affected products. Customers are strongly advised to apply these patches promptly to mitigate the risk. Until patches are applied, risk reduction may be possible by blocking required network protocols or restricting privileges, but these may affect functionality. No known exploits in the wild have been reported at this time.
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-35269 is a high-severity vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0. It allows an unauthenticated attacker with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical or all accessible data within Identity Manager. The vulnerability affects the REST WebServices component and has a CVSS 3.1 base score of 7.5, primarily impacting data integrity.
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).