What is the CVSS score of CVE-2026-35265?

CVE-2026-35265 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Identity Manager are affected by CVE-2026-35265?

Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 contain a critical account takeover vulnerability (CVE-2026-35265, CVSS 8.8) exploitable by low-privileged attackers with HTTP access; no…

How to fix or mitigate CVE-2026-35265?

24 hours: Inventory all Oracle Identity Manager instances and confirm versions (12.2.1.4.0 and 14.1.2.1.0); document network accessibility and authentication requirements. 7 days: Deploy network-level compensating controls including WAF rules to restrict HTTP access, enforce multi-factor authentication for all service accounts, and enable detailed authentication logging. 30 days: Establish patch preparation plan; monitor Oracle Security Advisories for patched versions and schedule immediate upgrade upon release.

Oracle Identity Manager CVE-2026-35265

EUVD-2026-37397 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Authentication Bypass Oracle Identity Manager Oracle Corporation

8.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable HTTP endpoint (AV:N), no described preconditions (AC:L), requires a low-privileged authenticated OIM account (PR:L), no user interaction, and full takeover yields C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:17 vuln.today

DescriptionCVE.org

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged remote attacker with HTTP access to fully compromise the Identity Manager component of Oracle Fusion Middleware. With a CVSS 3.1 base score of 8.8 and high impact across confidentiality, integrity, and availability, successful exploitation results in takeover of the identity governance platform itself. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

Oracle Identity Manager is the identity governance and administration (IGA) component of Oracle Fusion Middleware, responsible for provisioning, role management, password management, and access certification across enterprise applications. The advisory categorizes the flaw under the 'Security' subcomponent and the CPE confirms the affected product as cpe:2.3:a:oracle_corporation:identity_manager. No CWE was assigned in the input, but Oracle's wording ('takeover of Identity Manager' from a low-privileged authenticated session over HTTP) is consistent with an authorization or privilege-management weakness (CWE-285/CWE-269 class) in the web-facing identity console or its REST/SOAP APIs, where an authenticated user can escalate to administrative control of the IGA platform.

RemediationAI

Apply the patches delivered in the Oracle Critical Patch Update of June 2026 as documented at https://www.oracle.com/security-alerts/cspujun2026.html - Oracle's CPU is the only sanctioned fix path for Fusion Middleware components. Patch available per vendor advisory; an exact post-fix Identity Manager build number is not stated in the input data and should be taken directly from the CPU patch availability table for 12.2.1.4.0 and 14.1.2.1.0. Until patching is complete, restrict network reachability of the Identity Manager HTTP endpoints (OIM console, /identity, /sysadmin, SPML/SCIM/REST APIs) to trusted administrative networks via WAF or network ACLs, tighten the privilege model so that 'low-privileged' end-user accounts cannot reach administrative paths, and increase auditing on role-assignment and entitlement changes - note that restricting the console will impact self-service password reset and access request flows for end users.