EUVD-2026-79513
GHSA-vf5x-fhrc-c9m8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vendor describes easily exploitable unauthenticated HTTP takeover with full C/I/A loss, so AV:N/AC:L/PR:N/UI:N and C:H/I:H/A:H are all justified; no cross-component scope change.
Primary rating from Vendor (oracle).
CVSS VectorVendor: oracle
Lifecycle Timeline
2DescriptionCVE.org
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
AnalysisAI
Unauthenticated, network-positioned attackers can fully take over Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 by bypassing authentication in the Core component (CVE-2026-70913), which carries a CVSS 3.1 base score of 9.8 using the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Oracle characterizes the flaw as easily exploitable over HTTP, meaning no credentials, no user interaction, and no non-default configuration are required - only HTTP reachability to an affected instance - and successful exploitation gives complete loss of confidentiality, integrity, and availability on the identity platform. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation over HTTP against Oracle Identity Manager (Core component), versions 12.2.1.4.0 and 14.1.2.1.0, per the CVSS vector AV:N/AC:L/PR:N/UI:N. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-priority vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Oracle fix referenced by the vendor security alert at https://www.oracle.com/security-alerts/cspusep2026.html; the provided data does not specify an exact patched version number, so treat this as patch-available-per-vendor-advisory and confirm the precise OIM bundle/patch release against My Oracle Support before scheduling maintenance. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, produce a complete inventory of all Oracle Identity Manager instances, confirming which run 12.2.1.4.0 or 14.1.2.1.0, and immediately reduce exposure by removing internet or broad network reachability: take externally facing instances offline or place them behind an access-controlled gateway, and restrict inbound HTTP/HTTPS to trusted administrative networks. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today