EUVD-2026-61405
GHSA-8g9x-6cr9-rrx9
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Remote HTTP vector with low complexity and no interaction; a low-privilege account suffices (PR:L), and identity-broker takeover crosses trust boundaries (S:C) with full C/I/A loss.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. While the vulnerability is in Oracle Identity Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
AnalysisAI
Full compromise of Oracle Identity Manager (OIM Legacy UI component) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.1.0 is achievable by a low-privileged attacker over HTTP, resulting in complete takeover of the OIM instance. Because the flaw carries a scope change, successful exploitation can significantly impact additional connected products beyond OIM itself, elevating this from a single-product compromise to a potential identity-fabric breach. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network HTTP access to the Oracle Identity Manager Legacy UI component and a single low-privileged authenticated OIM account (CVSS PR:L) - no administrative privileges and no user interaction (UI:N) are needed, and attack complexity is low (AC:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Every available severity signal points the same direction: CVSS 3.1 is 9.9 with AV:N/AC:L/PR:L/UI:N/S:C and full C:H/I:H/A:H, meaning remote, low-complexity, single-low-privilege exploitation with no user interaction and cross-boundary impact - Oracle itself labels it 'easily exploitable.' The only mitigating factor is PR:L: an attacker needs some authenticated foothold (any low-privilege OIM account) rather than being fully anonymous, which slightly narrows the exposure to environments where low-tier accounts are broadly issued or where credential theft is feasible. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: apply the fixes delivered in Oracle's Critical Patch Update of August 2026 (https://www.oracle.com/security-alerts/cspuaug2026.html) for the affected Oracle Identity Manager releases 12.2.1.4.0 and 14.1.2.1.0; Oracle CPUs do not publish a standalone semantic fix version, so identify the exact patch bundle for your release from that advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Immediately inventory all Oracle Fusion Middleware deployments to identify systems running OIM versions 12.2.1.4.0 or 14.1.2.1.0 and isolate them from untrusted network access; contact Oracle for interim guidance. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Identity Manager
View allVMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templa
VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a privilege escalation vulnerability. Rat
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due t
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability aff
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability aff
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated cr
Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: Default Account). Rate
Open redirect vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) becaus
Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: Rules Engine). Rated c
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today