Oracle Identity Manager EUVD-2026-37399

Attacker requires network reachability to the Oracle WebLogic T3 or IIOP listener fronting Identity Manager (typically TCP 7001/7002 in default deployments) and a valid low-privileged Identity Manager account, as indicated by PR:L in the CVSS vector. Limiting factors: T3/IIOP listeners are frequently restricted to internal management networks via WebLogic Connection Filters, and organizations that have already locked these protocols down to trusted subnets significantly reduce exposure. Affected only on Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 - other Fusion Middleware versions outside this range are not in scope per the vendor advisory.

The CVSS 9.9 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) signals genuinely high real-world risk: network-reachable, low complexity, only low privileges required, no user interaction, and full CIA impact with scope change. The T3/IIOP attack surface is well-known to attackers - prior Oracle WebLogic CVEs on these protocols have repeatedly been exploited en masse - which means that even without a current public POC, exploitation tooling can emerge quickly once a patch is reverse-engineered. EPSS, KEV listing, and POC availability were not provided in the input, so widespread exploitation cannot be confirmed; however, the combination of a central identity product, low PR, and scope change places this above typical 9.9 issues in priority. The PR:L requirement is the only meaningful brake - an attacker still needs some valid Identity Manager credentials, which is consistent with exposed admin portals or compromised low-tier service accounts.

An attacker who has obtained a low-privilege Identity Manager account - for example through phishing a helpdesk user or reusing credentials from a prior breach - connects to the WebLogic T3 or IIOP listener and sends a crafted request that abuses Identity Manager logic to escalate to full product takeover. Because the scope changes, the attacker pivots from Identity Manager into the broader Fusion Middleware domain, harvesting credentials and provisioning rogue accounts across downstream applications. No public POC is identified at time of analysis, but the historical pattern of T3/IIOP issues suggests proof-of-concept code is likely to surface after patch diffing.