Oracle Identity Manager CVE-2026-70913

No special conditions - remote unauthenticated exploitation over HTTP against Oracle Identity Manager (Core component), versions 12.2.1.4.0 and 14.1.2.1.0, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The only practical limiting factors are network reachability of the OIM HTTP interface (an internet-exposed instance is fully at risk; an internal-only instance narrows the attacker population) and running one of the affected versions. No authentication, no user interaction, and no non-default configuration are required according to the vector and Oracle's 'easily exploitable' characterization.

This is a genuine top-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) describes fully remote, network-based (HTTP), low-complexity exploitation with no privileges and no user interaction, resulting in complete confidentiality, integrity and availability compromise - Oracle itself characterizes it as 'easily exploitable' resulting in full 'takeover of Oracle Identity Manager.' Because Oracle Identity Manager is an identity/access-governance product, a takeover is unusually consequential: it can cascade into downstream account and credential compromise across every system it provisions. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no confirmed active exploitation - the severity rests on the vendor CVSS and the pre-auth nature of the flaw rather than observed attacks. The one caveat is that Oracle CPU advisories are deliberately terse: the underlying technical mechanism (the specific CWE-287 authentication-bypass path) is not disclosed, so exploitation feasibility cannot be independently corroborated beyond Oracle's own 'easily exploitable' framing. Net: treat as high-urgency patching given the pre-auth full-takeover profile, while noting exploitation-in-the-wild is not yet evidenced.

An unauthenticated attacker with network reach to an internet- or intranet-exposed Oracle Identity Manager instance sends crafted HTTP request(s) that abuse the authentication weakness (CWE-287) in the Core component, bypassing login to gain control of the IAM platform. Once the identity manager is taken over, the attacker can read and manipulate provisioned identities and credentials, achieving full confidentiality, integrity and availability compromise. No public exploit code was identified in the provided data, and there is no evidence of active exploitation at time of analysis.