Identity Manager

Local privilege escalation in Oracle Identity Manager's Installer component allows a low-privileged authenticated attacker to fully compromise the OIM instance on versions 12.2.1.4.0 and 14.1.2.1.0. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms that any low-privileged OS user with local logon access to the OIM infrastructure can achieve complete confidentiality, integrity, and availability impact - effectively a full system takeover - with low complexity and no user interaction required. No public exploit identified at time of analysis, and no CISA KEV listing has been confirmed.

Full takeover of Oracle Identity Manager (OIM) is achievable by any low-privileged, network-authenticated attacker exploiting a flaw in the OIM Legacy UI component of Oracle Fusion Middleware. Both actively supported versions - 12.2.1.4.0 and 14.1.2.1.0 - are affected, and the attack requires only HTTP network access with minimal credentials, yielding complete confidentiality, integrity, and availability compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and high impact make this a high-priority patching target.

Full takeover of Oracle Identity Manager is possible when a low-privileged attacker reaches the OIM Legacy UI component over the network via RMI, per Oracle's August 2026 Critical Patch Update (CVE-2026-61066). The flaw carries a CVSS 3.1 base score of 9.9 with a scope change, meaning successful exploitation can compromise the identity platform itself and cascade into other products that trust it. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and identity-provider blast radius make it a top-priority patch.

Remote takeover of Oracle Identity Manager (Oracle Fusion Middleware) affects the OIM Legacy UI component in versions 12.2.1.4.0 and 14.1.2.1.0, allowing an unauthenticated attacker with only HTTP network access to fully compromise the identity-management platform. The maximum CVSS 3.1 base score of 9.8 reflects complete loss of confidentiality, integrity, and availability, and because OIM governs enterprise identity and access, compromise cascades to every system it provisions. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation profile makes it a high priority for immediate patching.

Oracle Identity Manager (OIM Legacy UI) in versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware allows a low-privileged remote attacker to fully take over the identity management platform via the T3 and IIOP protocols. The attack requires no user interaction and low complexity, resulting in complete confidentiality, integrity, and availability compromise of the OIM system. No public exploit has been identified at time of analysis, but the low barrier to exploitation makes this a critical patching priority for any enterprise running the affected versions.

Full product takeover in Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 (Legacy UI component) allows a remote, unauthenticated attacker to compromise the identity-governance platform over HTTP. Rated CVSS 9.8 with high confidentiality, integrity, and availability impact, this issue is trivially exploitable and requires no user interaction; at time of analysis there is no public exploit identified and it is not listed in CISA KEV. Because OIM brokers provisioning and access to downstream enterprise systems, a takeover here has cascading blast radius across connected accounts and applications.

Full compromise of Oracle Identity Manager (OIM Legacy UI component) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.1.0 is achievable by a low-privileged attacker over HTTP, resulting in complete takeover of the OIM instance. Because the flaw carries a scope change, successful exploitation can significantly impact additional connected products beyond OIM itself, elevating this from a single-product compromise to a potential identity-fabric breach. Disclosed in Oracle's August 2026 Critical Patch Update with a CVSS 3.1 base score of 9.9; no public exploit identified at time of analysis.

Full system takeover of Oracle Identity Manager is achievable by low-privileged network attackers via the OIM Legacy UI component using the T3 or IIOP protocols. Affected versions are 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware's Identity Manager product. Successful exploitation yields complete compromise of confidentiality, integrity, and availability, effectively handing an attacker full control over the identity management platform. No public exploit has been identified at the time of analysis, and this issue is disclosed as part of Oracle's Critical Patch Update for August 2026.

Full takeover of Oracle Identity Manager via its Legacy UI component is achievable by any low-privileged, network-authenticated attacker over HTTP. Affects Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0, with complete confidentiality, integrity, and availability impact - Oracle's own advisory characterizes the outcome as system takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity (AC:L) and minimal privilege bar (PR:L) make this a realistic target once any authenticated foothold exists in an exposed OIM deployment.

Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 expose a high-severity Security component flaw enabling authenticated high-privileged attackers to compromise the system via HTTP, with confirmed scope change affecting additional downstream products. Exploitation allows complete unauthorized read and write access to all OIM-accessible data, including critical identity and access management records. No public exploit has been identified at time of analysis, and this vulnerability was disclosed as part of Oracle's Critical Patch Update for August 2026.

Unauthenticated remote compromise of Oracle Identity Manager (OIM Legacy UI component) in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0 allows attackers with only network/HTTP access to read, create, delete, or modify any data the identity platform can reach. Tagged by the reporter as an authentication bypass, this flaw carries a CVSS 9.1 rating driven by high confidentiality and integrity impact, and because OIM governs enterprise identity and account provisioning, a successful attack effectively hands over control of user identity data. There is no public exploit identified at time of analysis and this CVE is not listed in CISA KEV.

Complete takeover of Oracle Identity Manager is possible through its OIM Legacy UI component, allowing a remote unauthenticated attacker with only HTTP network access to fully compromise the confidentiality, integrity, and availability of the identity governance platform. Affected releases are the Fusion Middleware bundles 12.2.1.4.0 and 14.1.2.1.0. Oracle rates this CVSS 9.8 and addressed it in the July 2026 Critical Patch Update; no public exploit identified at time of analysis.

Unauthenticated data compromise in Oracle Identity Manager (Fusion Middleware, OIM Legacy UI component) versions 12.2.1.4.0 and 14.1.2.1.0 lets remote attackers read and modify all OIM-accessible data over HTTP. Tagged as an authentication bypass, the flaw carries a CVSS 9.1 and was addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis.

Broad data compromise in Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 (Fusion Middleware REST WebServices component) lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the identity platform. Tagged as an authentication-bypass class issue with CVSS 3.1 8.1, it grants high confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis, and it is addressed in the Oracle Critical Patch Update of July 2026.

Privilege-escalation-to-takeover in Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 (OIM Legacy UI component) allows a low-privileged, authenticated attacker with HTTP network access to fully compromise the product, with a scope change that can significantly impact additional connected products. Rated CVSS 3.1 8.5 (High) with full confidentiality, integrity, and availability impact, though the AC:H metric marks it as difficult to exploit. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.

Remote takeover of Oracle Identity Manager (Oracle Fusion Middleware, OIM Legacy UI component) allows an unauthenticated network attacker to fully compromise the identity governance server via the T3 and IIOP protocols. Oracle rates it CVSS 3.1 9.8 with high confidentiality, integrity and availability impact and describes it as 'easily exploitable', meaning a successful attack yields complete product takeover. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the low complexity and unauthenticated network vector make it a top-priority patch.

Unauthenticated network exploitation of Oracle Identity Manager's End User Self Service component via the IIOP protocol allows partial read and write access to identity data in versions 12.2.1.4.0 and 14.1.2.1.0. The authentication bypass tag alongside a PR:N CVSS vector confirms no credentials are required, making this accessible to any attacker who can reach the IIOP endpoint. No public exploit or active exploitation has been identified at time of analysis, but the sensitivity of identity governance data elevates the practical risk beyond the moderate CVSS score alone.

Remote unauthenticated takeover of Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 is possible via the OIM Legacy UI component when reachable over T3 or IIOP protocols, per Oracle's June 2026 Critical Patch Update advisory. The flaw scores CVSS 9.8 with full confidentiality, integrity, and availability impact, and no public exploit identified at time of analysis. Because Identity Manager governs enterprise identity and access provisioning, successful exploitation effectively yields a tier-zero compromise of the IAM control plane.

Unauthorized data modification in Oracle Identity Manager (Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.1.0 allows a remote unauthenticated attacker to create, delete, or modify critical identity data via the REST WebServices component over HTTP. Oracle rates the issue as easily exploitable with a CVSS 3.1 base score of 7.5 (integrity-only impact), and no public exploit has been identified at time of analysis.

Account takeover in Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 (Fusion Middleware Core component) allows a low-privileged remote attacker to fully compromise the product via T3 or IIOP protocols, with scope change extending impact to other Fusion Middleware components. The CVSS 9.9 score reflects high confidentiality, integrity, and availability impact combined with low attack complexity. No public exploit identified at time of analysis, but Identity Manager's role as a central identity authority makes this a critical patching priority.

Account takeover in Oracle Identity Manager (Fusion Middleware) versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged remote attacker to fully compromise the Identity Manager instance via its REST WebServices component over HTTP. Oracle rates the flaw CVSS 8.8 with high impact to confidentiality, integrity, and availability, and no public exploit identified at time of analysis. Because Identity Manager governs enterprise identity lifecycle and provisioning, successful exploitation has cascading impact across downstream applications it manages.

Account takeover in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged remote attacker with HTTP access to fully compromise the Identity Manager component of Oracle Fusion Middleware. With a CVSS 3.1 base score of 8.8 and high impact across confidentiality, integrity, and availability, successful exploitation results in takeover of the identity governance platform itself. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

VMware Workspace ONE Access and VMware Identity Manager contain an insecure redirect vulnerability. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.

VMware Workspace ONE Access and Identity Manager contain an authenticated remote code execution vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a reflected cross-site scripting (XSS) vulnerability. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

VMware Workspace ONE Access, Identity Manager, Connectors and vRealize Automation contain a path traversal vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two privilege escalation vulnerabilities. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a privilege escalation vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This SQL Injection vulnerability could allow attackers to execute arbitrary SQL commands against the database.

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.

VMware Workspace ONE Access and Identity Manager contain a URL injection vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Open Redirect vulnerability could allow attackers to redirect users to malicious websites via URL manipulation.

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an information disclosure vulnerability due to returning excess information. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a cross site request forgery vulnerability. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.

VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. This Deserialization of Untrusted Data vulnerability could allow attackers to execute arbitrary code through malicious serialized objects.

VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.

VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

VMware Workspace ONE Access 21.08, 20.10.0.1, and 20.10 and Identity Manager 3.3.5, 3.3.4, and 3.3.3 contain an SSRF vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Server-Side Request Forgery (SSRF) vulnerability could allow attackers to make the server perform requests to unintended internal or external resources.

VMware Workspace ONE Access and Identity Manager, unintentionally provide a login interface on port 7443. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

VMware Workspace ONE Access and Identity Manager, allow the /cfg web app and diagnostic endpoints, on port 8443, to be accessed via port 443 using a custom host header. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access.

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Identity Console). Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Request Management & Workflow). Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

NetIQ Identity Manager 4.8 prior to version 4.8 SP2 HF1 are affected by an injection vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Dashboards and progressiveProfileForms in ForgeRock Identity Manager before 7.0.0 are vulnerable to stored XSS. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Elevation of privilege and/or unauthorized access vulnerability in Micro Focus Identity Manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Advanced Console). Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: OIM - LDAP user and role Synch). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: Advanced Console). Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity.

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: Advanced Console). Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

The NetIQ Identity Manager, in versions prior to 4.7, userapp with log / trace enabled may leak sensitive information. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

The NetIQ Identity Manager user console, in versions prior to 4.7, is susceptible to URL redirection. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

The NetIQ Identity Manager communication channel, in versions prior to 4.7, is susceptible to a DoS attack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

The NetIQ Identity Manager driver log file, in versions prior to 4.7, provides details that could aid in system enumeration. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

The NetIQ Identity Manager driver log file, in versions prior to 4.7, provides details that could aid in system or configuration enumeration. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

NetIQ Identity Manager driver, in versions prior to 4.7, allows for an SSL handshake renegotiation which could result in a MITM attack. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Microsoft Identity Manager 2016 SP1 allows an attacker to gain elevated privileges when it does not properly sanitize a specially crafted attribute value being displayed to a user on an affected MIM. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.

Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: Default Account). Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 13.8%.

CA Identity Manager r12.6 to r12.6 SP8, 14.0, and 14.1 allows remote attackers to potentially identify passwords of locked accounts through an exhaustive search. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware (subcomponent: Rules Engine). Rated critical severity (CVSS 9.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

VMware Identity Manager 2.x before 2.7.1 and vRealize Automation 7.x before 7.2.0 allow remote attackers to read /SAAS/WEB-INF and /SAAS/META-INF files via unspecified vectors. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Exposure of Resource to Wrong Sphere vulnerability could allow attackers to access resources from an unintended security context.

XSS in NetIQ IDM 4.5 Identity Applications before 4.5.4 allows attackers able to change their username to inject arbitrary HTML code into the Role Assignment administrator HTML pages. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

XSS in NetIQ Designer for Identity Manager before 4.5.3 allows remote attackers to inject arbitrary HTML code via the nrfEntitlementReport.do CGI. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

XSS in NetIQ Designer for Identity Manager before 4.5.3 allows remote attackers to inject arbitrary HTML code via the accessMgrDN value of the forgotUser.do CGI. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Unspecified vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware allows local users to affect confidentiality and integrity via vectors related to App Server. Rated low severity (CVSS 3.1), this vulnerability is low attack complexity.

VMware Identity Manager 2.x before 2.7 and vRealize Automation 7.0.x before 7.1 allow local users to obtain root access via unspecified vectors. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

The MKDQUOTESAFE function in the Fan-out driver scripts in Fan-Out Platform Services in Novell Identity Manager (aka IDM) 4.0.2 allows local users to execute arbitrary commands by leveraging. Rated medium severity (CVSS 4.6), this vulnerability is low attack complexity.

Open redirect vulnerability in the Oracle Identity Manager component in Oracle Fusion Middleware 11.1.1.5, 11.1.1.7, 11.1.2.1, and 11.1.2.2 allows remote attackers to redirect users to arbitrary web. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 11.4%.