What is the CVSS score of EUVD-2026-47402?

EUVD-2026-47402 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Identity Manager are affected by EUVD-2026-47402?

Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 are vulnerable to complete remote system compromise by unauthenticated attackers, enabling full control of identity governance operations…

How to fix or mitigate EUVD-2026-47402?

Within 24 hours: Apply Oracle's July 2026 Critical Patch Update to all Fusion Middleware instances running OIM versions 12.2.1.4.0 or 14.1.2.1.0, verifying successful patch installation through Oracle's validation procedures. Within 7 days: Audit identity governance systems for unauthorized access or privilege escalation, review OIM Legacy UI component access logs for exploitation attempts prior to patching, and validate that no unauthorized administrative modifications to user accounts, roles, or access policies occurred. Within 30 days: For any systems with delayed patching, implement network segmentation restricting Legacy UI access, deploy Web Application Firewall rules to block exploitation patterns, and plan migration to OIM versions 14.1.2.2.0 or later if available.

Identity Manager EUVD-2026-47402

| CVE-2026-61196 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-21 secalert_us@oracle.com

GHSA-fp97-p4jv-99pq

Authentication Bypass Oracle Identity Manager

9.8

CVSS 3.1 · Vendor: oracle

Severity by source

Vendor (oracle) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (oracle) · only source for this CVE.

CVSS VectorVendor: oracle

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 00:15 vuln.today

CVE Published

Jul 21, 2026 - 22:18 nvd

CRITICAL 9.8

DescriptionCVE.org

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

AnalysisAI

Complete takeover of Oracle Identity Manager is possible through its OIM Legacy UI component, allowing a remote unauthenticated attacker with only HTTP network access to fully compromise the confidentiality, integrity, and availability of the identity governance platform. Affected releases are the Fusion Middleware bundles 12.2.1.4.0 and 14.1.2.1.0. Oracle rates this CVSS 9.8 and addressed it in the July 2026 Critical Patch Update; no public exploit identified at time of analysis.