Oracle Identity Manager EUVD-2026-61402

Exploitation requires a high-privileged account within Oracle Identity Manager with network connectivity to the OIM HTTP interface. The CVSS vector PR:H confirms authenticated access at an elevated privilege level is mandatory - unauthenticated exploitation is not indicated by available data. The 'Authentication Bypass' tag suggests the bypass operates at the authorization or security-boundary layer post-authentication rather than at the login gate, but this interpretation is inferred and not explicitly confirmed in the description. The vulnerability is exploitable across both supported release lines (12.2.1.4.0 and 14.1.2.1.0). Scope change conditions indicate that connected Oracle Fusion Middleware or provisioning targets must be integrated with OIM for downstream impact to materialize. No non-default configuration flags or specific features are named as prerequisites in the available description.

CVSS 3.1 Base Score of 8.7 is driven primarily by the scope change and high confidentiality/integrity impacts despite the PR:H requirement, which normally dampens severity. The attack vector is network (HTTP) with low complexity and no user interaction, meaning exploitation is straightforward once the attacker holds a high-privileged account in OIM. The 'Authentication Bypass' tag creates a notable tension with the PR:H metric: if high privileges are required, the bypass may refer to circumventing internal permission boundaries or security zones after authentication, rather than bypassing the authentication gate itself - this should be verified against the vendor advisory. EPSS score is not available in the provided data, limiting probabilistic exploitation forecasting. KEV status is not confirmed, and no POC is identified, suggesting this is not yet being actively weaponized in the wild. The real-world risk is elevated for organizations running OIM as a central identity authority: compromise of OIM's security component with scope change could expose connected systems' user provisioning data, credentials, or access policies. Priority should be high for OIM-dependent enterprises despite the high privilege prerequisite, because privileged accounts in identity management systems are frequent targets for lateral movement.

An attacker with a compromised or maliciously obtained high-privileged OIM administrator account sends crafted HTTP requests to the OIM Security component interface, triggering an authorization bypass that grants access to data or operations beyond the account's intended scope. This could allow the attacker to read all identity data stored in OIM - including user credentials, roles, and entitlements - and modify provisioning records to escalate privileges across connected downstream systems. No public proof-of-concept exploit code is known at time of analysis, but the 'easily exploitable' classification indicates low technical barrier once the prerequisite access exists.