EUVD-2026-61406
GHSA-ch3x-g2j3-w7jw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach OIM Legacy UI over HTTP
-
DeliverySend crafted unauthenticated request
-
ExploitTrigger takeover flaw in legacy handler
-
ExecutionGain control of Identity Manager
-
ImpactManipulate accounts and downstream provisioning
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation over HTTP against supported deployments of Oracle Identity Manager (versions 12.2.1.4.0 and 14.1.2.1.0) that expose the OIM Legacy UI component. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication and no user interaction are required. The primary limiting factor is reachability of the Legacy UI: exploitation requires network HTTP access to that specific component, so instances where the Legacy UI is disabled, not deployed, or firewalled off from the attacker are not exposed. Affected only on the two named supported versions. |
| Impact | Every available signal points to genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) indicates network-reachable, low-complexity, unauthenticated exploitation with total impact to all three security properties. No EPSS score was provided, so exploitation-probability cannot be quantified from this data; no SSVC decision record was supplied either. The vulnerability is NOT in CISA KEV and no POC was referenced, so exploitation is neither confirmed active nor publicly weaponized at this time. That said, OIM is a high-value identity-governance target and Oracle-authored (secalert_us@oracle.com) confirmation of a full-takeover, unauthenticated bug means this should be treated as urgent regardless of the currently unknown EPSS. The gap to flag: severity is vendor/NVD-confirmed but real-world exploitation likelihood is unmeasured here - absence of KEV/POC data is not evidence of low risk given the trivial attack profile. |
| Exploit ScenarioDerived | An attacker who can reach the OIM Legacy UI over HTTP sends a crafted unauthenticated request to the vulnerable endpoint and, with no valid credentials and no user interaction, gains control of the Oracle Identity Manager instance. From that foothold the attacker can create or elevate accounts and manipulate provisioning across every downstream system OIM governs. No public exploit is identified at time of analysis, so this scenario is inferred from the CVSS profile rather than an observed POC. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 18, 2026
Full product takeover in Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 (Legacy UI component) allows a remote, unauthenticated attacker to compromise the identity-governance platform over HTTP. Rated CVSS 9.8 with high confidentiality, integrity, and availability impact, this issue is trivially exploitable and requires no user interaction; at time of analysis there is no public exploit identified and it is not listed in CISA KEV. Because OIM brokers provisioning and access to downstream enterprise systems, a takeover here has cascading blast radius across connected accounts and applications.
RemediationAI
Apply the fixes delivered in Oracle's August 2026 Critical Patch Update (Patch available per vendor advisory) documented at https://www.oracle.com/security-alerts/cspuaug2026.html; Oracle does not publish standalone fix version strings in the CPU note, so the CPU bundle itself is the patch - an exact patched build number is not independently confirmed from the provided data. Prioritize patching given the unauthenticated 9.8 rating. Until the CPU is applied, reduce exposure by restricting network access to the OIM Legacy UI: place OIM behind a VPN or trusted-network segment, block external HTTP/HTTPS reachability to the console at the load balancer or WAF, and if the Legacy UI is not operationally required, disable or restrict its endpoint (trade-off: administrators relying on the legacy interface lose access and must use the newer UI). These are compensating controls only and do not substitute for the CPU.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Identity Manager (OIM) is the identity-lifecycle and access-provisioning module of Oracle Fusion Middleware, deployed on WebLogic and used to manage user accounts, roles, and entitlements across an enterprise. The flaw resides in the 'OIM Legacy UI' component - an older web-facing interface still shipped in supported releases. Oracle's advisory does not assign a CWE (CWE listed as N/A) and provides no technical detail on the root cause; the 'takeover' phrasing combined with an unauthenticated network vector is consistent with classes such as authentication bypass, deserialization, or injection in the legacy request-handling path, but the specific mechanism is not disclosed. No CPE strings were provided in the intelligence set, so affected components are identified from Oracle's version list rather than NVD CPE matching.
Know when Identity Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor describes easily exploitable, unauthenticated HTTP takeover with full compromise, so AV:N/AC:L/PR:N/UI:N and C/I/A all High.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Identity Manager (OIM) versions 12.2.1.4.0 and 14.1.2.1.0 contain a critical vulnerability permitting complete unauthenticated remote takeover of the identity governance platform, with no patch currently available. Because OIM controls identity provisioning and access for downstream enterprise systems, compromise enables attackers to create accounts, modify permissions, and manipulate access across the organization's entire application portfolio. Every organization deploying these versions requires immediate compensating controls to prevent cascading account compromise and unauthorized system access.
Restrict Oracle Identity Manager access to dedicated administrative networks via firewall rules and VPN enforcement; deploy Web Application Firewall rules targeting the legacy UI component; enable comprehensive audit logging and real-time alerting on all identity and provisioning operations; segment OIM from internet-facing and untrusted networks; implement monitoring for anomalous role assignments and privilege escalation across downstream managed systems; conduct weekly reviews of authentication logs and administrative activity for indicators of compromise.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Identity Manager
View allUnauthenticated remote takeover of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 is possible through the REST WebSer
VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templa
VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a privilege escalation vulnerability. Rat
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due t
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability aff
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability aff
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated cr
Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: Default Account). Rate
Open redirect vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) becaus
Exploit-DB