Oracle Identity Manager EUVD-2026-61409

The prerequisite is network HTTP(S) reachability to an Oracle Identity Manager instance running the OIM Legacy UI component on affected versions 12.2.1.4.0 or 14.1.2.1.0. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, no user interaction, and no special configuration are required, so default-configured, network-exposed instances are directly exploitable. The primary limiting factor is exposure: deployments where the OIM web interface - and specifically the legacy UI - is not reachable from the attacker's network, or has been disabled, are not exploitable, and instances on unaffected version branches are out of scope.

All available signals point to genuine high priority rather than an inflated-CVSS issue: the vector AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H means remote, low-complexity, unauthenticated exploitation requiring no user interaction and yielding total compromise. No EPSS score, SSVC decision, POC reference, or KEV entry was provided in the input, so real-world exploitation probability cannot be quantified and active exploitation is not confirmed - treat exploitation as 'no public exploit identified at time of analysis.' The absence of a CWE and of technical detail from Oracle is a real data gap, but the description ('unauthenticated network takeover') is fully consistent with the CVSS vector with no conflicts, so the raw 9.8 severity should be treated as credible pending exploitation telemetry.

An attacker who can reach the Oracle Identity Manager web interface over the network sends crafted HTTP requests to the OIM Legacy UI without any credentials and gains full control of the identity-management platform. From there the attacker can read or forge identities, harvest stored credentials, and provision access to every downstream system OIM manages. No public exploit is identified at time of analysis, but the low attack complexity (AC:L) and lack of authentication make weaponization straightforward once details emerge.