Oracle Identity Manager EUVD-2026-37398

Requires network reachability to the Oracle Identity Manager REST WebServices interface over HTTP, plus possession of any low-privileged authenticated IdM account (PR:L) - typically a standard provisioned end-user, not an administrator. No user interaction is needed (UI:N) and the affected versions are specifically 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware Identity Manager. Exploitation is limited by: (1) the REST WebServices endpoint must be exposed to the attacker's network position (internet-exposed IdM deployments are highest risk; internal-only deployments narrow the attacker pool to insiders or post-compromise pivots), and (2) the attacker must hold valid credentials for at least one IdM identity, which in self-service-enabled deployments may be trivial to obtain.

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable, low-complexity flaw requiring only a low-privileged account and no user interaction, yielding full CIA compromise - a strong real-world risk profile, especially because any legitimate IdM end-user is sufficient. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so weaponization is not yet evidenced; however, Identity Manager is a high-value target (it brokers identities across the enterprise), and Oracle Fusion Middleware CPU bugs have historically been reverse-engineered from patches within weeks. No SSVC decision data, no POC, and no third-party advisory were provided, so the assessment leans on Oracle's own CVSS - which is unusually consistent with the prose description ('easily exploitable', 'low privileged', 'takeover'), so no major signal conflict is apparent.

An attacker who has obtained or registered any low-privileged Identity Manager account (e.g., a standard end-user provisioned for self-service password reset) authenticates to the REST WebServices endpoint over HTTP/HTTPS and issues crafted requests that escalate to full administrative control over the Identity Manager instance. From that foothold the attacker can create privileged accounts, reset credentials, or push entitlements into downstream connected systems (AD, databases, SaaS), effectively pivoting from one low-privileged identity into broad enterprise access. No public exploit identified at time of analysis, but the low complexity and remote vector make POC development straightforward once the patch is diffed.