Description
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-07-21
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Oracle Identity Manager’s Legacy UI contains an authentication bypass that allows an attacker with network access to an unprotected HTTP endpoint to execute arbitrary actions and ultimately take possession of the entire OIM instance. The weakness is a failure to protect authentication credentials, identified as CWE‑306, and the CVSS 3.1 Base Score of 9.8 reflects severe confidentiality, integrity, and availability impacts.

Affected Systems

The vulnerability affects Oracle Corporation’s Oracle Identity Manager product, specifically versions 12.2.1.4.0 and 14.1.2.1.0. These are the only supported releases listed by the CNA.

Risk and Exploitability

The CVSS score indicates a critical threat, but the EPSS score of less than 1% suggests the vulnerability is currently unlikely to be exploited in the wild; however, it is listed as not yet in the CISA KEV catalog. Attackers can exploit the flaw remotely over HTTP without authentication, meaning any user with network reach to the OIM web interface can take over the system.

Generated by OpenCVE AI on August 4, 2026 at 01:25 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply Oracle’s CPU Jul 2026 patch that fixes the OIM Legacy UI authentication bypass.
  • Restrict network access to the OIM web UI from external networks, allowing only trusted internal IPs or VPN connections.
  • Enforce HTTPS and disable plain HTTP for all OIM web interfaces to prevent credential exposure.

Generated by OpenCVE AI on August 4, 2026 at 01:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 01:45:00 +0000

Type Values Removed Values Added
Title Authentication Bypass in Oracle Identity Manager Legacy UI

Thu, 30 Jul 2026 11:30:00 +0000

Type Values Removed Values Added
Title Authentication Bypass in Oracle Identity Manager Legacy UI

Tue, 28 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Code Execution in Oracle Identity Manager Legacy UI

Thu, 23 Jul 2026 21:45:00 +0000

Type Values Removed Values Added
Title Unauthenticated Remote Code Execution in Oracle Identity Manager Legacy UI

Wed, 22 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle identity Manager
CPEs cpe:2.3:a:oracle:identity_manager:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:identity_manager:14.1.2.1.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle identity Manager
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Identity Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-01T03:56:02.465Z

Reserved: 2026-07-08T15:52:20.740Z

Link: CVE-2026-61196

cve-icon Vulnrichment

Updated: 2026-07-22T19:24:03.437Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T01:30:04Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function