EUVD-2026-47402
GHSA-fp97-p4jv-99pq
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Complete takeover of Oracle Identity Manager is possible through its OIM Legacy UI component, allowing a remote unauthenticated attacker with only HTTP network access to fully compromise the confidentiality, integrity, and availability of the identity governance platform. Affected releases are the Fusion Middleware bundles 12.2.1.4.0 and 14.1.2.1.0. Oracle rates this CVSS 9.8 and addressed it in the July 2026 Critical Patch Update; no public exploit identified at time of analysis.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Identity Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (oracle) · only source for this CVE.
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 are vulnerable to complete remote system compromise by unauthenticated attackers, enabling full control of identity governance operations including user authentication and privileged account management. This directly threatens access control enforcement, authentication decisions, and regulatory compliance across the enterprise. Oracle released a patch in the July 2026 Critical Patch Update, requiring immediate deployment.
Within 24 hours: Apply Oracle's July 2026 Critical Patch Update to all Fusion Middleware instances running OIM versions 12.2.1.4.0 or 14.1.2.1.0, verifying successful patch installation through Oracle's validation procedures. Within 7 days: Audit identity governance systems for unauthorized access or privilege escalation, review OIM Legacy UI component access logs for exploitation attempts prior to patching, and validate that no unauthorized administrative modifications to user accounts, roles, or access policies occurred. Within 30 days: For any systems with delayed patching, implement network segmentation restricting Legacy UI access, deploy Web Application Firewall rules to block exploitation patterns, and plan migration to OIM versions 14.1.2.2.0 or later if available.
Apply vendor patch: Oracle July 2026 Critical Patch Update. If patch deployment must be delayed, restrict network access to the OIM Legacy UI component via firewall rules, implement WAF rules targeting exploitation attempts, and isolate affected identity governance systems from the broader network pending patch deployment.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Identity Manager
View allUnauthenticated remote takeover of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 is possible through the REST WebSer
VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templa
VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a privilege escalation vulnerability. Rat
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due t
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability aff
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability aff
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated cr
Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: Default Account). Rate
Open redirect vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) becaus
Exploit-DB