EUVD-2026-37325Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
OIM Legacy UI is reachable over T3/IIOP without authentication or interaction, and successful exploitation yields full takeover of Identity Manager, so AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Remote unauthenticated takeover of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 is possible via the OIM Legacy UI component when reachable over T3 or IIOP protocols, per Oracle's June 2026 Critical Patch Update advisory. The flaw scores CVSS 9.8 with full confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The OIM Legacy UI component of Oracle Identity Manager 12.2.1.4.0 or 14.1.2.1.0 must be deployed and the WebLogic T3 or IIOP listener (typically the admin/managed server port, 7001/7002 by default) must be reachable from the attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All available signals point to top-priority risk: the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H describes a low-complexity, network-reachable, unauthenticated, no-interaction path to full CIA impact, and Identity Manager itself is a high-value identity authority whose compromise cascades to every downstream system it provisions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with TCP reach to the WebLogic managed server hosting OIM (for example via an exposed admin port or a foothold in an adjacent VLAN) opens a T3 or IIOP connection to the OIM Legacy UI listener and sends a crafted request that yields control of the Identity Manager runtime without supplying credentials. With Identity Manager compromised, the attacker can forge provisioning workflows, create or elevate identities, and pivot into every connected target system (AD, databases, SaaS) that OIM federates with. … |
| Remediation | Apply the patches delivered in Oracle's June 2026 Critical Patch Update (https://www.oracle.com/security-alerts/cspujun2026.html) to the affected 12.2.1.4.0 and 14.1.2.1.0 Identity Manager branches; Oracle's advisory page lists the exact CPU bundle for each version and is the authoritative source for fix identifiers. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all OIM 12.2.1.4.0 and 14.1.2.1.0 instances; restrict network access to T3 and IIOP protocols via firewall; enable enhanced audit logging. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Identity Manager
View allVMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth
VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side templa
VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a privilege escalation vulnerability. Rat
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due t
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability aff
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability aff
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated cr
Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: Default Account). Rate
Open redirect vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) becaus
Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: Rules Engine). Rated c
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today