EUVD-2026-46738
GHSA-x9p5-9qjm-93gj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege OIM user
-
DeliveryReach Legacy UI over HTTP
-
ExploitSend crafted request bypassing authorization
-
ExecutionRead or modify unauthorized identity data
-
ImpactAlter accounts and entitlements
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the Oracle Identity Manager HTTP interface and a valid low-privileged account (CVSS PR:L) - it is not fully unauthenticated despite the 'Authentication Bypass' tag. The specific required surface is the OIM Legacy UI component in versions 12.2.1.4.0 or 14.1.2.1.0; deployments that do not expose the legacy UI, or that restrict it to trusted networks, materially limit exposure. No user interaction and no high privileges are needed (UI:N, AC:L), so any authenticated low-privilege user able to reach the legacy UI over HTTP satisfies the conditions. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) describes an easily exploitable, network-reachable flaw requiring only low privileges and no user interaction, yielding high confidentiality and integrity impact with no availability effect - score 8.1 (High). This is a credible real-world priority because OIM sits at the center of enterprise access control, so unauthorized read/write to 'all accessible data' can undermine the trust boundary of the entire IAM tier. No EPSS score, KEV listing, or POC was provided, so probabilistic and active-exploitation signals are absent; this is a newly disclosed CPU item with no public exploit identified at time of analysis, not confirmed exploited. One tension to verify with Oracle: the tag says 'Authentication Bypass' yet the vector requires PR:L (an authenticated low-privilege user) - treat this as authenticated privilege/authorization escalation rather than fully unauthenticated bypass unless Oracle clarifies otherwise. |
| Exploit ScenarioDerived | A low-privileged user holding valid but limited OIM credentials sends crafted HTTP requests to the Legacy UI component and gains read and write access to identity records outside their authorized scope, allowing them to view sensitive account data and create, alter, or delete privileged entitlements. No public exploit code was identified at time of analysis, and because no user interaction is required (UI:N) and attack complexity is low (AC:L), exploitation would be a direct request-based attack by any actor holding a foothold account. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 21, 2026
Data compromise in Oracle Identity Manager (OIM Legacy UI component) versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged, network-based attacker to read, create, delete, or modify all data accessible to the identity platform. The flaw is tracked in Oracle's July 2026 Critical Patch Update and carries a CVSS 3.1 score of 8.1 with high confidentiality and integrity impact. No public exploit has been identified at time of analysis, but the low attack complexity and network vector make it a strong patching priority for enterprise IAM deployments.
RemediationAI
Patch available per vendor advisory: apply the fixes bundled in the Oracle Critical Patch Update of July 2026 (https://www.oracle.com/security-alerts/cpujul2026.html) for the affected Oracle Identity Manager releases 12.2.1.4.0 and 14.1.2.1.0 - Oracle does not publish a standalone semantic fix version, so use the CPU patch identifiers listed in the advisory for your exact release. As compensating controls until patching, restrict network reachability of the OIM Legacy UI to trusted administrative networks or VPN, and where operationally feasible disable or block access to the legacy UI endpoints in favor of the current UI (trade-off: legacy integrations or admin workflows depending on it will break). Additionally tighten and audit low-privilege OIM role assignments and enable request/access logging to detect anomalous data reads or modifications; these do not remove the flaw but reduce the population of accounts that can reach it.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Identity Manager is an enterprise identity-governance and access-provisioning platform within Oracle Fusion Middleware, managing user accounts, roles, and entitlements across connected systems. The vulnerable surface is the legacy OIM web UI, reached over HTTP. Oracle assigned no CWE; the vendor tag 'Authentication Bypass' combined with the CVSS PR:L metric indicates an authenticated low-privilege user can escalate their effective data authorization - accessing or altering records beyond their intended scope - pointing to a broken access-control / authorization-flaw class rather than a fully pre-authentication bypass. Because OIM is itself the authority for identity data, an integrity compromise here can cascade into unauthorized account and entitlement changes across downstream managed systems.
Know when Oracle Identity Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Network-reachable HTTP UI exploitable by an authenticated low-privilege user with no interaction (PR:L, AC:L), giving high confidentiality and integrity impact but no availability effect.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
Executive ViewAI
Oracle Identity Manager (versions 12.2.1.4.0 and 14.1.2.1.0) contains a high-severity flaw allowing low-privileged network attackers to read, create, delete, or modify all identity data in the platform, directly compromising the organization's authentication and authorization infrastructure. An attacker exploiting this vulnerability could alter user identities, permissions, and access controls across dependent systems, creating both immediate data breach risk and regulatory compliance violations. This represents a critical threat to the foundational trust layer of enterprise security.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) restrict network access to OIM administrative interfaces via firewall and IP whitelisting; (2) enforce multi-factor authentication for OIM administrative accounts; (3) implement database-level row-level security policies to limit identity data visibility; (4) enable comprehensive audit logging of all identity data access and modifications with real-time alerting for anomalies; (5) conduct immediate privilege access reviews and remove unnecessary administrative permissions. These controls reduce risk exposure but do not eliminate the vulnerability; vendor patching remains essential upon availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB