Oracle Identity Manager EUVD-2026-106513

Exploitation requires the attacker to already hold a low-privileged authenticated account on the target (CVSS PR:L) and network HTTP access to the OIM Legacy UI component of Oracle Identity Manager; the specific affected component is the legacy user interface in versions 12.2.1.4.0 and 14.1.2.1.0. No user interaction is required (UI:N) and attack complexity is low (AC:L). The limiting factors are the authentication requirement (any valid low-privilege credential) and exposure of the legacy UI endpoint - instances that disable the Legacy UI or restrict network reachability reduce exposure. This is not remote-unauthenticated, so the realistic threat is a malicious or compromised low-privilege user rather than an anonymous internet attacker.

This is a genuine high priority based on the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8): network-reachable over HTTP, low attack complexity, no user interaction, and full confidentiality/integrity/availability impact culminating in complete takeover of Oracle Identity Manager. The one gating factor is PR:L - the attacker needs an existing low-privileged account, which tempers the raw score somewhat but is a low bar in a large IAM deployment with many provisioned users. No EPSS score, KEV listing, or public POC was provided in the input, so there is no evidence of active exploitation or weaponization at this time; the risk assessment rests on the vector and the vendor's 'takeover' language rather than observed attacks. Note a signal conflict: the input Tags label this 'Information Disclosure,' yet the description and the I:H/A:H impacts describe full system takeover, not mere disclosure - the tag understates the impact and should not be relied upon. Because this product is a central identity/access management system, a takeover has outsized blast radius (control over authentication and provisioning), so it warrants prioritized patching via the Oracle October 2026 CPU despite the absence of exploitation telemetry.

An attacker who holds any low-privileged account on an internet- or intranet-reachable Oracle Identity Manager instance sends crafted HTTP requests to the OIM Legacy UI component. By abusing the flaw they escalate from their limited account to full control, resulting in takeover of the Identity Manager and its managed identities. No public exploit code was identified in the provided data, and exploitation requires authentication.