EUVD-2026-106321
GHSA-w7f5-7hm6-6r6c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privileged OIM account
-
DeliveryReach OIM Legacy UI over HTTP
-
ExploitSend crafted request exploiting flaw
-
ExecutionEscalate to full OIM control
-
ImpactTakeover identity/entitlement management
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to already hold a low-privileged, authenticated Oracle Identity Manager account (PR:L) and network HTTP reachability to the OIM Legacy UI component on affected versions 12.2.1.4.0 or 14.1.2.1.0; no victim user interaction is needed (UI:N). The primary limiting factors are the need for valid low-privilege credentials and that the vulnerable Legacy UI component must be deployed and network-accessible - fully unauthenticated external exploitation is NOT indicated by the CVSS vector. |
| Impact | This is a genuine high-priority vulnerability. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes network-reachable exploitation over HTTP with low attack complexity, no user interaction, and only low privileges required, yielding full confidentiality, integrity, and availability impact - Oracle explicitly characterizes successful attacks as 'takeover of Oracle Identity Manager.' Because OIM is a central identity and access management control point, compromise has outsized downstream consequences (credential and entitlement manipulation across connected systems). However, several key real-world signals are MISSING: no EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no evidence of active or at-scale exploitation at this time - the risk rating rests on CVSS severity and the sensitivity of the asset, not on observed exploitation. One tagging inconsistency exists: the input is tagged 'Information Disclosure,' yet the CVSS vector shows I:H and A:H and the description states full takeover, so the impact is far broader than disclosure alone - verify scope against the Oracle advisory. The PR:L requirement is the main mitigating factor: an attacker needs some valid low-privileged access rather than being fully unauthenticated. |
| Exploit ScenarioDerived | An attacker holding a low-privileged but valid Oracle Identity Manager account sends crafted HTTP requests to the OIM Legacy UI component to escalate into full control of the identity manager. No user interaction or victim is required, and because OIM governs identities and entitlements, the attacker can then leverage that takeover to manipulate accounts and access across connected systems. No public exploit code is identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Low-privileged authenticated users can achieve full takeover of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 through the OIM Legacy UI component, which is reachable over HTTP and requires no victim interaction. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects complete loss of confidentiality, integrity and availability, but exploitation is gated on an attacker already holding a valid low-privilege OIM account plus network reachability to the deployed Legacy UI - unauthenticated external exploitation is not indicated by the assessed vector. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, so the practical risk is highest for environments where the Legacy UI is exposed to broad network segments or where low-privilege accounts are weakly governed.
RemediationAI
Apply the Oracle Critical Patch Update published in the October 2026 advisory (https://www.oracle.com/security-alerts/cpuoct2026.html), which is the vendor remediation reference for CVE-2026-83403; the provided data does not specify an exact patched version string, so confirm the fixed build for 12.2.1.4.0 and 14.1.2.1.0 directly against that advisory before upgrading. Where patching must be staged, reduce exposure by disabling or undeploying the OIM Legacy UI if it is not actively used - the trade-off is that any legacy self-service or administrative workflows still bound to that interface will break, so confirm dependencies first. If the Legacy UI must remain available, restrict HTTP access to it through network segmentation or a reverse proxy allowlist limited to administrative subnets, accepting that this complicates access for legitimate remote users. In parallel, audit and minimize low-privilege OIM accounts and enforce least-privilege role assignments, since a valid low-privilege account is the sole prerequisite the assessed vector requires; this does not remove the flaw but raises the cost of exploitation. Monitor OIM application and Legacy UI access logs for anomalous privileged operations originating from ordinary user accounts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Identity Manager is the identity governance and provisioning component of Oracle Fusion Middleware, and this issue lives specifically in its OIM Legacy UI - the older administrative/self-service web interface that is typically deployed alongside the modern console and is served over HTTP. The vulnerability class is not mapped to a specific CWE in the provided data, so the root cause cannot be pinned to a named weakness family; what the CVSS vector establishes is the exploitation profile: network vector (AV:N), low attack complexity (AC:L), low privileges required (PR:L), and no user interaction (UI:N), with unchanged scope and high impact across all three CIA dimensions. In practice this means a holder of any ordinary low-privilege OIM account can drive the Legacy UI into a state that yields administrative control of the product itself - for example through privilege escalation or manipulation of identity objects - rather than merely reading another user's data. Because OIM is an identity provider-adjacent system, compromise of the OIM application can cascade into downstream systems whose credentials, provisioning workflows, and role assignments it manages. Organizations should inventory whether the Legacy UI is actually deployed and reachable, since removal or network isolation of that component materially shrinks the attack surface independent of patching.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network HTTP vector (AV:N), low complexity, and a required low-privilege account (PR:L) leading to full takeover justify C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Identity Manager's Legacy UI component in versions 12.2.1.4.0 and 14.1.2.1.0 permits a low-privileged authenticated user to escalate to full administrative control of the identity platform, exposing the system that governs access provisioning across the enterprise. Because no vendor fix is currently available, any organization running these versions with broadly reachable Legacy UI endpoints or loosely managed low-privilege accounts carries elevated exposure to insider misuse or compromised-credential abuse. Leadership should care because full takeover of the identity manager can cascade into unauthorized access to downstream applications and services enterprise-wide.
No vendor-released patch identified at time of analysis. Interim mitigations: disable or decommission the OIM Legacy UI where not required; restrict network reachability to the Legacy UI to trusted administrative segments via segmentation and firewall rules; enforce least privilege and aggressively prune low-privilege OIM accounts; require strong authentication and monitor Legacy UI activity for anomalous privilege escalation; pursue vendor remediation timeline through Oracle support.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB