Oracle Identity Manager EUVD-2026-37400

The OIM managed server's REST WebServices endpoints must be reachable over HTTP from the attacker's network position - typically the WebLogic-hosted /iam/governance/* or equivalent REST URIs on the OIM admin/managed server port. No authentication, user interaction, or special configuration is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N), and the deployment must be running Identity Manager 12.2.1.4.0 or 14.1.2.1.0 with the unpatched June 2026 CPU baseline. Exploitation is limited where OIM is deployed behind a perimeter or zero-trust gateway that blocks unauthenticated access to its REST surface, which is a common (though not universal) hardening pattern for internet-exposed Fusion Middleware.

The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N is a near-worst-case integrity profile: remote, unauthenticated, low complexity, no user interaction, with high integrity impact and no confidentiality or availability loss - meaning an attacker can tamper with identity data but not necessarily read it or crash the service. Oracle explicitly labels the flaw 'easily exploitable,' which raises real-world priority above raw CVSS for an identity governance system where unauthorized account creation or modification is effectively a privilege escalation path into every downstream application OIM provisions. No EPSS score, KEV listing, or POC has been provided, so exploitation appears opportunistic-grade rather than confirmed in the wild; however, Oracle Fusion Middleware CPU vulnerabilities historically attract exploit development within weeks of disclosure, so the absence of public POC today should not be treated as durable. CWE is unassigned, which is a minor data gap - the precise weakness class (auth bypass vs. injection vs. IDOR) cannot be confirmed without the Oracle advisory body.

An attacker on the network reaches the OIM REST WebServices HTTP endpoint and issues a crafted unauthenticated request that the server processes as if it came from a privileged caller, creating a new administrative account or modifying an existing user's role assignments. Because OIM provisions identities to downstream Oracle and third-party systems, the attacker's injected account propagates outward, yielding access to applications well beyond OIM itself. No public POC has been identified at time of analysis, but the 'easily exploitable' label from Oracle suggests low reverse-engineering effort once the CPU patch is diffed.