Oracle Identity Manager CVE-2026-71111

The attacker must possess an existing low-privileged account with local logon access to the host operating system where Oracle Identity Manager is running - this is mandated by the CVSS vector AV:L/PR:L. The vulnerable component is specifically the Installer, meaning the attack surface is tied to Installer artifacts or processes present on the OIM host. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once local access is established, exploitation is described by Oracle as 'easily exploitable.' Exploitation is strictly limited to local access - remote unauthenticated attack is not possible. Additional limiting factors include the requirement that the attacker already hold OS-level credentials on the OIM infrastructure, making this a higher risk in shared-server or multi-tenant environments than in fully isolated dedicated OIM deployments.

The vendor-assigned CVSS 3.1 score of 7.8 (High) reflects a local, low-complexity, low-privilege attack with no user interaction and a full system takeover result. The local attack vector (AV:L) is the primary limiting factor - remote network exploitation is categorically ruled out by the CVSS vector, constraining the threat actor population to those already holding OS-level accounts on the OIM host. In well-segmented enterprise environments, this significantly reduces real-world exposure. However, the 'easily exploitable' qualifier in the vendor description (consistent with AC:L/PR:L/UI:N) means that any insider or compromised low-privileged account on the OIM server translates directly into full system takeover. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified from available data. No KEV listing exists, indicating no confirmed active exploitation at time of analysis. No public POC is known. Despite the high CVSS, this is primarily a concern for organizations with shared or insufficiently controlled access to OIM infrastructure hosts.

An attacker with a valid low-privileged OS account on the Oracle Identity Manager server - for example, a developer or monitoring service account - targets a flaw in the Installer component to escalate their privileges. Leveraging the low-complexity nature of the attack (AC:L, UI:N), the attacker achieves full control over the OIM instance, gaining read/write access to all identity data, role assignments, and audit logs. No public exploit code has been identified at time of analysis.