Oracle Identity Manager CVE-2026-46807

The OIM Legacy UI component of Oracle Identity Manager 12.2.1.4.0 or 14.1.2.1.0 must be deployed and the WebLogic T3 or IIOP listener (typically the admin/managed server port, 7001/7002 by default) must be reachable from the attacker. Per CVSS AV:N/AC:L/PR:N/UI:N no authentication, user interaction, or non-default configuration is required beyond having the Legacy UI present and T3/IIOP enabled (both are on by default in standard WebLogic deployments). The practical limit on exploitation is therefore network exposure of the T3/IIOP port - installations that already firewall these protocols to admin-only subnets, or that have disabled the Legacy UI, materially reduce reachability.

All available signals point to top-priority risk: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes a low-complexity, network-reachable, unauthenticated, no-interaction path to full CIA impact, and Identity Manager itself is a high-value identity authority whose compromise cascades to every downstream system it provisions. No EPSS score, KEV listing, SSVC decision, or public POC was provided in the input, so real-world exploitation cadence cannot be quantified - however, Oracle Fusion Middleware T3/IIOP bugs have a strong historical track record of being weaponized within weeks of CPU disclosure, so the absence of POC data should not be read as low urgency. Conflicting/missing signals to verify: CWE is N/A and no technical write-up is referenced beyond Oracle's advisory, so the exact bug class (deserialization vs. auth bypass vs. logic flaw) is inferred rather than confirmed.

An attacker with TCP reach to the WebLogic managed server hosting OIM (for example via an exposed admin port or a foothold in an adjacent VLAN) opens a T3 or IIOP connection to the OIM Legacy UI listener and sends a crafted request that yields control of the Identity Manager runtime without supplying credentials. With Identity Manager compromised, the attacker can forge provisioning workflows, create or elevate identities, and pivot into every connected target system (AD, databases, SaaS) that OIM federates with. No public exploit identified at time of analysis, but T3/IIOP issues in Fusion Middleware are historically reproduced quickly once a CPU ships.