What is the CVSS score of CVE-2026-46807?

CVE-2026-46807 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Identity Manager are affected by CVE-2026-46807?

Oracle Identity Manager (versions 12.2.1.4.0 and 14.1.2.1.0) is subject to a critical vulnerability (CVSS 9.8) enabling unauthenticated remote takeover via the Legacy UI component; while no public…

How to fix or mitigate CVE-2026-46807?

Within 24 hours: Identify all OIM 12.2.1.4.0 and 14.1.2.1.0 instances; restrict network access to T3 and IIOP protocols via firewall; enable enhanced audit logging. Within 7 days: Implement network segmentation isolating OIM from untrusted networks; consult Oracle support on patch timeline and interim mitigations; deploy SIEM rules for exploitation indicators. Within 30 days: Apply vendor patch immediately upon availability; for systems requiring extended delay, implement strict firewall rules and WAF controls to restrict Legacy UI protocol access; conduct access review for unauthorized privilege escalations.

Oracle Identity Manager CVE-2026-46807

EUVD-2026-37325 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-06-16 oracle

Authentication Bypass Oracle Identity Manager Oracle Corporation

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

OIM Legacy UI is reachable over T3/IIOP without authentication or interaction, and successful exploitation yields full takeover of Identity Manager, so AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 22:53 vuln.today

DescriptionCVE.org

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Remote unauthenticated takeover of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 is possible via the OIM Legacy UI component when reachable over T3 or IIOP protocols, per Oracle's June 2026 Critical Patch Update advisory. The flaw scores CVSS 9.8 with full confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis. Because Identity Manager governs enterprise identity and access provisioning, successful exploitation effectively yields a tier-zero compromise of the IAM control plane.

Technical ContextAI

Oracle Identity Manager is the IAM provisioning, reconciliation, and access-governance component of Oracle Fusion Middleware, traditionally hosted on WebLogic Server. The vulnerable surface is the OIM Legacy UI exposed through WebLogic's proprietary T3 protocol and CORBA-based IIOP, both of which historically carry Java object streams and have repeatedly been abused for unauthenticated deserialization-driven RCE in Fusion Middleware (no CWE was supplied, so the precise root-cause class is unconfirmed, but T3/IIOP attack vectors are overwhelmingly deserialization or authentication-bypass issues). The CPE cpe:2.3:a:oracle_corporation:identity_manager:*:*:*:*:*:*:*:* combined with the EUVD-listed versions 12.2.1.4.0 and 14.1.2.1.0 narrows exposure to those two long-term-support branches.

RemediationAI

Apply the patches delivered in Oracle's June 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspujun2026.html) to the affected 12.2.1.4.0 and 14.1.2.1.0 Identity Manager branches; Oracle's advisory page lists the exact CPU bundle for each version and is the authoritative source for fix identifiers. Until the CPU bundle can be applied, restrict network reachability of the WebLogic T3 (default 7001/7002) and IIOP listeners hosting OIM Legacy UI to trusted administrative networks only, enable the WebLogic connection filter (weblogic.security.net.ConnectionFilterImpl) to deny T3/T3s/IIOP/IIOPS from untrusted sources, and consider disabling IIOP on the managed server hosting OIM if it is not in active use - note these controls can break legitimate admin tooling, JMS clients, and inter-domain federation that rely on T3/IIOP, and they do not protect against an attacker already inside the management VLAN.