Oracle Identity Manager EUVD-2026-106744

The attacker must have a valid low-privileged account AND local logon access to the infrastructure/host where Oracle Identity Manager executes (AV:L, PR:L) - the Installer component is the affected surface. No user interaction is required (UI:N). Only Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 are affected. The decisive limiting factor is that exploitation is purely local: it cannot be launched remotely over the network, so an attacker must first gain authenticated shell/console access to the OIM server, which sharply narrows realistic exposure to insiders or attackers who have already obtained a foothold on that host.

This is a medium-severity local information-disclosure flaw (CVSS 3.1 base 5.5) in the Installer component of Oracle Identity Manager, addressed as part of the Oracle Critical Patch Update of October 2026. The provided CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) shows the key limiting factor clearly: exploitation requires local logon access to the host where OIM runs and a pre-existing low-privileged account - it is NOT remotely reachable. Impact is confined to confidentiality (C:H), with no integrity or availability effect. No EPSS exploitation-probability score was provided, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced, so the real-world exploitation signal is 'no public exploit identified at time of analysis.' Taken together, these signals point to a lower-priority, prerequisite-heavy issue rather than a mass-exploitation threat - patch on the normal Oracle CPU cadence with attention to multi-user/shared OIM hosts. CONFLICT TO NOTE: the input carries an 'Authentication Bypass' tag, but the CVSS vector requires authentication (PR:L) and the description explicitly requires a logged-on low-privileged attacker - this is an authenticated local disclosure, not an authentication bypass; treat the tag as unreliable.

A low-privileged user who already has interactive logon access to the server hosting Oracle Identity Manager abuses a flaw in the Installer component to read critical data that OIM can access, resulting in unauthorized disclosure of sensitive identity information. Because the attack is local (AV:L) with low complexity (AC:L) and no user interaction, any authenticated local account on that host could trigger it. No public proof-of-concept is referenced in the available data.