Oracle Identity Manager CVE-2026-83042

No special conditions - remote unauthenticated exploitation over HTTP against Oracle Identity Manager instances whose OIM Legacy UI component is network-reachable (AV:N/AC:L/PR:N/UI:N). The primary limiting factor is exposure of the OIM Legacy UI to the attacker's network path: instances behind network segmentation, VPN, or reverse-proxy restrictions that block direct HTTP access to the Legacy UI are not exploitable by external actors. Affected versions are strictly 12.2.1.4.0 and 14.1.2.1.0; other versions are out of scope. Because it is a legacy UI component, environments that have decommissioned or disabled that interface reduce their exposure.

This is a genuine high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) is internally consistent and describes a network-reachable, pre-authentication, low-complexity flaw yielding full confidentiality, integrity, and availability compromise - a complete takeover of Oracle Identity Manager (CWE-287, authentication bypass). No conflicting signals exist between the vector and the description; both agree on unauthenticated HTTP exploitation. The score is well-calibrated (not inflated), matching the pattern of the strongest siblings in this same Oracle September 2026 CPU (e.g. WebLogic Web Container CVE-2026-83021 at 10.0, OAM CVE-2026-73947 at 9.8). However, exploitation-likelihood signals are entirely ABSENT: no EPSS score, no SSVC decision data, no POC, and no CISA KEV listing are provided. Absence of these is not evidence of low risk - it reflects that Oracle CPU advisories publish zero technical detail (no endpoint, parameter, or PoC), which delays public exploit development but does not reduce inherent severity. The compounding factor is that OIM is a centralized identity/access management system: a full takeover here cascades into control over downstream provisioning, entitlements, and connected systems, making it an unusually high-value target. Priority should be HIGH for patching despite no confirmed active exploitation.

An unauthenticated attacker who can reach the OIM Legacy UI over HTTP sends a crafted request that bypasses authentication (CWE-287), gaining administrative control of the Oracle Identity Manager instance. Because OIM governs identity provisioning and entitlements, the attacker can then read sensitive identity data, forge or escalate accounts, and disrupt the service. No public exploit code is identified at time of analysis, and Oracle's advisory provides no technical detail.