Oracle Identity Manager CVE-2026-35265

The attacker must (1) have network HTTP/HTTPS reachability to an Oracle Identity Manager 12.2.1.4.0 or 14.1.2.1.0 deployment, and (2) hold valid credentials for any low-privileged account on that Identity Manager instance (PR:L in the CVSS vector). No user interaction is required (UI:N), attack complexity is low (AC:L), and exploitation is not gated by any non-default configuration mentioned in the Oracle advisory - any supported install of the affected versions exposing the OIM HTTP interface to a population of low-privileged users is in scope. Limiting factors are therefore the credential requirement and whether the OIM HTTP endpoints are reachable from the attacker's network position; internet-exposed OIM consoles raise risk significantly.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, score 8.8) signals a high-priority issue: network-reachable, low complexity, no user interaction, only a low-privileged account required, and full CIA impact. Because Identity Manager is itself the system that controls access to other enterprise applications, 'takeover' here has cascading blast radius beyond the host - an attacker can mint, modify, or escalate identities across all downstream integrated systems. Counter-balancing signals are limited: there is no EPSS score, KEV listing, SSVC decision, or public POC in the provided data, which suggests opportunistic mass exploitation is not yet observed. The main uncertainty is the exact attack surface (web UI vs. SOA/REST APIs) and whether 'low privileged' means any authenticated Identity Manager user or any Fusion Middleware account - the advisory does not clarify, so defenders should assume the broader interpretation until Oracle's CPU note disambiguates.

An attacker who has obtained any low-privileged Identity Manager account - for example via phishing a help-desk or self-service portal user, or by abusing a default/test account - authenticates to the OIM HTTP interface over the network and issues a crafted request to a vulnerable endpoint to escalate to full administrative control of Identity Manager. From that position the attacker creates a privileged identity, assigns themselves enterprise-wide entitlements through OIM's downstream connectors, and pivots into integrated systems (Active Directory, databases, SaaS apps). No public POC is referenced in the available data.