Threat Intelligence Database

A high-severity vulnerability exists in Oracle Identity Manager, part of Oracle Fusion Middleware Core component, affecting versions 12.2.1.4.0 and 14.1.2.1.0. This vulnerability allows a low-privileged attacker with network access via HTTP to potentially take over the Oracle Identity Manager system. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes numerous security fixes across multiple Oracle products. Customers are strongly advised to apply the provided patches promptly to mitigate this risk.

A high-severity vulnerability exists in Oracle Identity Manager, part of Oracle Fusion Middleware Core component. The vulnerability affects versions 12.2.1.4.0 and 14.1.2.1.0 and allows a low-privileged attacker with network access via T3 or IIOP protocols to potentially take over the Oracle Identity Manager. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has released security patches addressing this vulnerability as part of its September 2026 Critical Security Patch Update.

CVE-2026-71047 is a high-severity vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0. It allows a low privileged attacker with network access via HTTP to compromise the product, potentially resulting in full takeover. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 8.8. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update advisory.

CVE-2026-70913 is a critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0. It allows an unauthenticated attacker with network access via HTTP to fully compromise the Oracle Identity Manager, potentially leading to complete takeover. The vulnerability has a CVSS 3.1 base score of 9.8, indicating high impact on confidentiality, integrity, and availability. Oracle has released security patches addressing this vulnerability as part of their September 2026 Critical Security Patch Update.

CVE-2026-71111 is a high-severity vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0. It allows a low privileged attacker with logon access to the infrastructure where Oracle Identity Manager runs to compromise the system, potentially leading to full takeover. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 7.8. Oracle has included fixes for this and many other vulnerabilities in their August 2026 Critical Security Patch Update.

CVE-2026-60707 is a high-severity vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0. It allows a high privileged attacker with network access via HTTP to compromise the product, potentially leading to unauthorized creation, deletion, or modification of critical data. The vulnerability has a CVSS 3.1 base score of 8.7, indicating significant confidentiality and integrity impacts. Exploitation may also affect additional Oracle products due to scope change. Oracle has published a Critical Security Patch Update advisory covering this and other vulnerabilities.