What is the CVSS score of EUVD-2026-37399?

EUVD-2026-37399 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Oracle Identity Manager are affected by EUVD-2026-37399?

Oracle Identity Manager (versions 12.2.1.4.0 and 14.1.2.1.0) contains a critical account takeover vulnerability (CVE-2026-35268, CVSS 9.9) allowing low-privileged remote attackers to fully compromise…

How to fix or mitigate EUVD-2026-37399?

Within 24 hours: Inventory all systems running vulnerable versions (12.2.1.4.0 and 14.1.2.1.0); assess current network exposure of T3 and IIOP protocols from external sources. Within 7 days: Implement network segmentation restricting T3/IIOP protocol access to trusted internal networks only; enable enhanced authentication logging and configure alerting for Identity Manager account anomalies. Within 30 days: Monitor Oracle security advisories for patched versions; develop and test upgrade procedures for both vulnerable versions; pre-stage testing and production environments for rapid deployment when patch becomes available.

Oracle Identity Manager EUVD-2026-37399

| CVE-2026-35268 CRITICAL

Improper Access Control (CWE-284)

2026-06-16 oracle

Oracle Identity Manager Authentication Bypass

9.9

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

9.9 CRITICAL

T3/IIOP is network-reachable (AV:N) with low complexity (AC:L); a valid low-priv IdM account is required (PR:L); scope change to WebLogic domain (S:C) with full takeover (C/I/A:H).

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:18 vuln.today

DescriptionCVE.org

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Identity Manager. While the vulnerability is in Identity Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

AnalysisAI

Account takeover in Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 (Fusion Middleware Core component) allows a low-privileged remote attacker to fully compromise the product via T3 or IIOP protocols, with scope change extending impact to other Fusion Middleware components. The CVSS 9.9 score reflects high confidentiality, integrity, and availability impact combined with low attack complexity. No public exploit identified at time of analysis, but Identity Manager's role as a central identity authority makes this a critical patching priority.

Technical ContextAI

Oracle Identity Manager is the identity governance and provisioning component of Oracle Fusion Middleware, responsible for managing user accounts, roles, and access entitlements across enterprise applications. The affected attack surface is the T3 (Oracle WebLogic's proprietary RMI protocol) and IIOP (CORBA's Internet Inter-ORB Protocol) listeners, which historically have been the vector for numerous WebLogic deserialization and remote code execution flaws. The CPE 'cpe:2.3:a:oracle_corporation:identity_manager' confirms the Identity Manager product itself, but the scope change (S:C) in the CVSS vector signals that exploitation crosses authorization boundaries - typical of WebLogic-hosted Java EE applications where compromising one deployed component yields control over the underlying server and adjacent applications. No CWE was assigned by Oracle, which is consistent with Oracle's standard CPU advisory practice of withholding root-cause detail.

RemediationAI

Apply the patches distributed in the Oracle Critical Patch Update referenced at https://www.oracle.com/security-alerts/cspujun2026.html - Oracle CPU patches are the authoritative fix for both 12.2.1.4.0 and 14.1.2.1.0 branches; exact patch IDs are listed in the CPU patch matrix. Until the CPU can be staged through change management, restrict network reachability of the T3 and IIOP listeners by configuring WebLogic Connection Filters (weblogic.security.net.ConnectionFilterImpl) to allow only trusted management subnets, and front the Identity Manager HTTP endpoints with an authenticating reverse proxy; note that filtering T3/IIOP may break legitimate inter-domain RMI calls and JMS clients, so test in a non-production domain first. Rotate any low-privilege Identity Manager credentials that may have been exposed, since PR:L means a single leaked account is sufficient for exploitation.