EUVD-2026-106659
GHSA-wf4r-5hrr-9j64
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged OIM account
-
DeliveryReach REST WebServices over HTTP
-
ExploitSend crafted API request
-
ExecutionAbuse flaw to escalate privileges
-
ImpactTake over Oracle Identity Manager
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network access to the Oracle Identity Manager REST WebServices (component: REST WebServices) over HTTP and a low-privileged authenticated account (CVSS PR:L) on the OIM instance - it is not exploitable fully unauthenticated. Affected deployments are Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0. No user interaction is needed (UI:N) and complexity is low (AC:L), so the main limiting factors are that the attacker must already hold valid low-privilege credentials and must be able to reach the REST endpoint, which is typically internal; internet-exposed OIM REST interfaces materially raise real-world risk. |
| Impact | This is a genuine high-priority vulnerability, not a high-CVSS-but-low-real-risk issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable flaw in the Oracle Identity Manager REST WebServices component that is low-complexity, requires only low privileges, needs no user interaction, and yields full confidentiality, integrity, and availability impact - Oracle explicitly describes the outcome as 'takeover of Oracle Identity Manager.' Because OIM is itself an identity and access governance system, compromise has outsized blast radius: an attacker gaining control of it can potentially manipulate provisioned accounts and entitlements across downstream systems. Against these strong technical signals, the exploitation-likelihood signals are weak or absent: no EPSS score was provided, there is no CISA KEV listing (not actively exploited per available data), and no public proof-of-concept was identified. The only reference is Oracle's October 2026 Critical Patch Update advisory, consistent with a vendor-reported, coordinated-disclosure finding rather than observed in-the-wild abuse. Note one conflict to verify: the input Tags label this 'Information Disclosure,' but the description and CVSS (I:H/A:H plus 'takeover') indicate full compromise well beyond disclosure - treat the tag as understating impact. |
| Exploit ScenarioDerived | An attacker who holds any low-privileged authenticated account on an exposed Oracle Identity Manager instance sends crafted HTTP requests to the REST WebServices endpoint over the network. Because attack complexity is low and no user interaction is needed, the request abuses the vulnerable REST interface to escalate into full control of the OIM deployment, resulting in takeover. No public exploit code was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Privilege escalation through the REST WebServices component of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged authenticated attacker with HTTP network access to take over the OIM deployment, with high confidentiality, integrity and availability impact (CVSS 8.8). Exploitation requires a valid low-privilege account on the target instance (PR:L) but no user interaction and only low attack complexity, so exposure hinges on whether the REST interface is reachable by untrusted networks. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was supplied with the source data.
RemediationAI
Apply the Oracle Critical Patch Update for October 2026 to Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0; the CPU advisory at https://www.oracle.com/security-alerts/cpuoct2026.html is the authoritative source for the exact patch identifiers and download locations, and no separate fix version is enumerated in the provided data. Where the CPU cannot be applied immediately, reduce exposure by blocking untrusted network paths to the OIM REST WebServices endpoints at the perimeter firewall or reverse proxy so only known integration hosts and administrative segments can reach them (trade-off: remote provisioning connectors, SSO integrations and mobile clients that call the REST API from outside that allowlist will break). Enforce authorization review on low-privilege OIM accounts, remove or disable service accounts with no active provisioning role, and alert on REST calls that mutate roles, entitlements or user credentials originating from low-privileged principals (trade-off: high-volume environments will generate tuning noise before the rules stabilise). Restrict access to the OIM administrative console and REST base paths at the WAF with method and path allowlists, and rotate credentials for any account suspected of being used to exercise the flaw.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Oracle Identity Manager is the identity governance and provisioning component of Oracle Fusion Middleware, exposing administrative and self-service functionality through its REST WebServices layer over HTTP. The affected code path sits in that REST component, and while no CWE identifier was supplied, the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is characteristic of an authorization or access-control weakness: an authenticated principal holding only low-privilege entitlements can invoke REST operations that should require elevated rights, resulting in full compromise of the OIM application with unchanged scope (the impact stays within the OIM security authority). The absence of a scope change indicates the flaw does not by itself cross a trust boundary into the host OS or another product, but takeover of OIM is significant because the product brokers identity lifecycle, provisioning and password operations for downstream systems. Because the flaw is reached over plain HTTP service endpoints rather than a local console, any deployment that terminates OIM REST traffic at an internet-facing reverse proxy, SSO gateway or WAF inherits a materially larger attack surface than one where OIM sits only on an internal management VLAN.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
REST endpoint is network-reachable (AV:N) with low complexity (AC:L); 'low privileged attacker' justifies PR:L, no user interaction (UI:N), and 'takeover' gives full C/I/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
DescriptionCVE.org
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Executive ViewAI
Oracle Identity Manager - the platform that governs who can access which enterprise systems - is exposed to a privilege-escalation flaw in its REST WebServices component across versions 12.2.1.4.0 and 14.1.2.1.0, allowing any holder of a routine low-privilege account to seize control of the entire identity deployment. Because the compromised system is the authoritative source of access rights, a successful takeover could let an attacker mint credentials, alter approval workflows, or provision themselves into downstream business applications, effectively converting one ordinary user account into enterprise-wide access. Leadership should care because the impacted asset is a trust anchor rather than a single application, and no vendor fix is currently available.
No vendor patch available. Interim mitigations: restrict network access to OIM REST WebServices to trusted segments only (deny internet and untrusted internal ranges); disable unused REST services and endpoints; enforce least privilege and aggressive lifecycle management on low-privilege accounts, disabling dormant ones; add WAF/reverse-proxy rules to block anomalous REST role and permission changes; enable detailed audit logging and alerting on REST administrative activity; and place all OIM instances behind VPN or gateway enforcement pending a vendor fix for 12.2.1.4.0 and 14.1.2.1.0.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB