Oracle Identity Manager EUVD-2026-61404

Exploitation requires the attacker to hold a low-privileged account within the Oracle Identity Manager environment - the CVSS vector PR:L confirms that some level of authentication is necessary, ruling out fully unauthenticated attacks. Network access to the OIM server via the T3 or IIOP protocols is required, which are WebLogic-based protocols typically listening on internal network ports. The OIM Legacy UI component must be present and accessible, which is the case for the two supported affected versions (12.2.1.4.0 and 14.1.2.1.0) by default. No user interaction is required (UI:N), and attack complexity is low (AC:L), meaning no race conditions, specific timing, or non-standard configurations are needed beyond basic authenticated network access. Exploitation is limited by the authentication requirement (PR:L) - fully anonymous external attackers cannot exploit this without first obtaining at least a low-privilege credential. Environments that restrict T3/IIOP port access via network controls would further limit exposure.

The CVSS 3.1 score of 8.8 (High) reflects a genuinely severe risk profile: network-accessible, low complexity, requiring only low privileges, with no user interaction needed, and full C/H/I/H/A/H impact leading to complete system takeover. The attack vector over T3/IIOP is noteworthy because these protocols are frequently exposed within enterprise internal networks and are not always adequately firewalled. The PR:L requirement means any authenticated user account - even a service account or a low-trust provisioned identity - is sufficient to trigger exploitation, which substantially broadens the attacker pool in environments with many managed identities. EPSS data is not available in the provided intelligence, and the vulnerability is not currently listed in the CISA KEV catalog, meaning confirmed active exploitation has not been documented at the time of analysis. No POC code has been publicly identified. Despite the absence of confirmed exploitation, the criticality of OIM as an identity governance platform means a successful attack would allow an adversary to manipulate identity provisioning, escalate privileges across connected systems, and potentially compromise every downstream application integrated with OIM - making even a mid-sized municipal IT team in boleslawiec responsible for an OIM deployment should treat this as urgent patching priority regardless of KEV status. The risk is real and systemic, not merely theoretical based on CVSS alone.

An attacker with a low-privileged account in the Oracle Identity Manager environment - such as a provisioned end-user or a compromised service account - connects to the OIM server over the T3 or IIOP protocol and sends a crafted request targeting the OIM Legacy UI component. No public POC has been identified, but the low attack complexity and straightforward network vector suggest exploitation does not require specialized tooling. Successful exploitation results in full control of the OIM platform, enabling the attacker to manipulate identity records, grant elevated access to connected systems, or exfiltrate sensitive identity and access management data.