What is the CVSS score of EUVD-2026-37400?

EUVD-2026-37400 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.4%.

Which versions of Oracle Identity Manager are affected by EUVD-2026-37400?

Oracle Identity Manager (Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.1.0 contain a remote unauthenticated vulnerability allowing attackers to create, delete, or modify critical identity records…

How to fix or mitigate EUVD-2026-37400?

Within 24 hours: Identify all systems running Oracle Identity Manager 12.2.1.4.0 or 14.1.2.1.0 and assess network exposure of the REST WebServices component. Within 7 days: Restrict HTTP/HTTPS access to the vulnerable REST WebServices endpoint to authorized internal networks only; enable detailed audit logging for all identity data modifications. Within 30 days: Monitor Oracle security advisories for patch releases; evaluate upgrade timeline to remediated versions or implement enhanced compensating controls if upgrades extend beyond 30 days.

Oracle Identity Manager EUVD-2026-37400

| CVE-2026-35269 HIGH

Improper Access Control (CWE-284)

2026-06-16 oracle

Authentication Bypass Oracle Identity Manager

7.5

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Remote unauthenticated HTTP exploitation per Oracle (AV:N/AC:L/PR:N/UI:N); integrity-only impact on identity data with no confidentiality or availability loss described.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (oracle).

CVSS VectorVendor: oracle

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 21:19 vuln.today

DescriptionCVE.org

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Identity Manager accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

AnalysisAI

Unauthorized data modification in Oracle Identity Manager (Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.1.0 allows a remote unauthenticated attacker to create, delete, or modify critical identity data via the REST WebServices component over HTTP. Oracle rates the issue as easily exploitable with a CVSS 3.1 base score of 7.5 (integrity-only impact), and no public exploit has been identified at time of analysis.

Technical ContextAI

Oracle Identity Manager (OIM) is the identity governance and provisioning module of Oracle Fusion Middleware, used to manage user accounts, roles, and entitlements across enterprise applications. The vulnerable component is the REST WebServices interface, which exposes HTTP endpoints for identity lifecycle operations. While no CWE is assigned in the input, the combination of unauthenticated network access leading to integrity-only impact is consistent with a missing or broken authentication/authorization check on REST endpoints - effectively an authentication bypass against APIs that should require privileged credentials. The CPE cpe:2.3:a:oracle_corporation:identity_manager:*:* covers all Identity Manager versions, but Oracle has scoped the advisory to the two listed supported releases.

RemediationAI

Apply the patches included in the Oracle Critical Patch Update of June 2026 as documented at https://www.oracle.com/security-alerts/cspujun2026.html - this is the authoritative fix for both 12.2.1.4.0 and 14.1.2.1.0. Until the CPU bundle can be deployed, restrict network access to the OIM REST WebServices endpoints (typically exposed on the SOA/managed-server HTTP ports) to trusted administrative networks via firewall, reverse-proxy ACLs, or a WAF rule blocking unauthenticated HTTP requests to /iam/governance and related REST URIs - note that this will break any legitimate cross-network integrations or self-service portals that rely on those endpoints, so coordinate with identity-integration owners. Increase audit logging on OIM for unexpected account create/modify/delete events as a detective control while patching is scheduled.