Oracle Identity Manager EUVD-2026-106320

Exploitation requires the attacker to hold a valid low-privileged account on the target (PR:L) and network access to the Oracle Identity Manager instance over HTTPS; the vulnerable code path is in the OIM Legacy UI component. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Limiting factors: only versions 12.2.1.4.0 and 14.1.2.1.0 are listed as affected; an authenticated (even if minimal) foothold is a prerequisite, so fully anonymous exploitation is not indicated; and exposure depends on whether the OIM Legacy UI is network-reachable to lower-trust users. Applying the October 2026 Oracle CPU removes the condition.

This is a genuine high-priority issue by severity signals. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw requiring only low privileges and no user interaction, with full confidentiality, integrity, and availability impact - consistent with Oracle's own 'easily exploitable' wording and the stated outcome of complete takeover of Oracle Identity Manager. However, the exploitation-likelihood signals are absent rather than reassuring: no EPSS score is provided, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. The signals are therefore not conflicting but incomplete - high intrinsic severity with unknown real-world exploitation. Oracle Identity Manager is a core identity/access-management control plane, so a full takeover has outsized blast radius (it governs authentication and provisioning for downstream systems), which argues for prompt patching via the October 2026 CPU despite the lack of observed exploitation. One caveat: PR:L means the attacker must already hold some authenticated (low-privilege) foothold, which moderates the 'unauthenticated internet worm' scenario.

An attacker who holds a low-privileged account on an internet- or intranet-reachable Oracle Identity Manager instance sends crafted HTTPS requests to the vulnerable OIM Legacy UI component. Exploitation requires no user interaction and low attack complexity, allowing the attacker to escalate from a minimal account to full compromise and takeover of the Identity Manager, and by extension the identities and access it governs. No public exploit code is identified at time of analysis.