Oracle Identity Manager EUVD-2026-106319

Exploitation requires the OIM Legacy UI component to be network-reachable over HTTP and, critically, requires human interaction from a person other than the attacker (UI:R) - a victim OIM user must be induced to interact with attacker-supplied content, so this cannot be exploited silently or automatically at scale. No authentication is required of the attacker (PR:N), but the attack depends on a valid user engaging with the malicious request, which is the primary limiting factor. The scope change (S:C) means impact can extend to additional products beyond OIM. Affected deployments are specifically Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 running the Legacy UI; environments not exposing the Legacy UI or that have mitigated client-side injection are less exposed.

This is a moderate-severity issue (CVSS 3.1 base 6.1) that should be patched on a normal cycle rather than treated as an emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows network-reachable, low-complexity, unauthenticated access, which raises exposure, but two factors materially limit real-world risk: successful exploitation requires human interaction from a victim other than the attacker (UI:R), and impact is limited to partial confidentiality and integrity loss with no availability impact (C:L/I:L/A:N). The scope change (S:C) is the most notable element - it indicates impact can extend beyond Oracle Identity Manager to additional products, which is why the score lands at 6.1 despite low individual impacts. No EPSS score, SSVC decision data, or CISA KEV entry is present in the provided intelligence, and no public exploit is referenced, so there is no public exploit identified at time of analysis. The combination of UI:R, scope change, and low confidentiality/integrity impact is the classic signature of a reflected/stored cross-site scripting or similar client-side injection flaw rather than a direct server compromise. Note a conflict in the input: the 'Authentication Bypass' tag is inconsistent with the actual vulnerability characteristics (user-interaction-dependent, low partial-impact, scope-change) - this does not read as an authentication bypass and the tag should be verified against the Oracle advisory.

An unauthenticated attacker crafts a malicious HTTP request or link targeting the OIM Legacy UI and lures a legitimate Oracle Identity Manager user (such as an administrator) into interacting with it. When the victim's browser processes the crafted content, injected script executes in the victim's authenticated context, allowing limited unauthorized read of OIM data and limited unauthorized update/insert/delete, with effects potentially crossing into additional products due to the scope change. No public exploit is identified at time of analysis.