Oracle Identity Manager EUVD-2026-79722

Requires the Oracle Identity Manager OIM Legacy UI component (versions 12.2.1.4.0 or 14.1.2.1.0) to be network-reachable over HTTP. The critical limiting factor is UI:R: a successful attack requires human interaction from a person other than the attacker - a legitimate OIM user or administrator must be induced to interact with attacker-supplied content (e.g., a crafted link or page). No attacker authentication is needed (PR:N), and complexity is low (AC:L), but the dependency on victim interaction makes this suited to targeted social engineering rather than fully automated exploitation. There is no availability impact.

This is a genuine high-severity issue but not the absolute top-tier of Oracle's September 2026 CPU. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) confirms remote, unauthenticated, low-complexity exploitation over HTTP, but two factors deliberately hold the score at 8.1 rather than 9.8: the required human interaction (UI:R) from a victim other than the attacker, and the absence of any availability impact (A:N). Confidentiality and integrity are both fully compromised (C:H/I:H), meaning an attacker can read and alter all OIM-accessible data - significant in an identity-management system that governs accounts and entitlements. No EPSS score, KEV listing, or public POC was provided, so exploitation probability signals are absent; there is no public exploit identified at time of analysis and no evidence of active exploitation. The UI:R requirement makes this better suited to targeted social-engineering (e.g., luring an authenticated admin or user to a crafted link/page) than to opportunistic automated mass-exploitation, which tempers real-world urgency somewhat despite the network/unauthenticated profile. Oracle's advisory (cspusep2026) provides zero technical detail, so the exact interaction and vulnerability class cannot be confirmed. The 'Authentication Bypass' tag overstates/mislabels the mechanism - this is a pre-auth flaw gated on user interaction, not a demonstrated auth-bypass, and the data-compromise nature (C/I) is not conveyed by that tag.

An unauthenticated attacker crafts a malicious HTTP request or link targeting the OIM Legacy UI and induces a legitimate user or administrator to interact with it (e.g., clicking a link or visiting a crafted page). Upon that interaction, the attacker gains unauthorized read and write access to all Oracle Identity Manager data - enabling account/entitlement manipulation and disclosure of identity data. No public exploit code is identified at time of analysis, and exploitation depends on successfully socially engineering a victim.