Description
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
Published: 2026-07-21
Score: 9.1 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability in Oracle Identity Manager’s Legacy UI allows an unauthenticated attacker with network access to create, delete, or modify critical data and to read all accessible data, effectively granting full administrative control. This flaw is a classic example of improper access control (CWE‑284) that directly affects confidentiality and integrity, rating a CVSS 3.1 base score of 9.1.

Affected Systems

Affected products are Oracle Identity Manager, version 12.2.1.4.0 and 14.1.2.1.0, as distributed under Oracle Fusion Middleware. No other vendors or product families are listed.

Risk and Exploitability

The vulnerability is easily exploitable over HTTP without authentication, though the EPSS score of less than 1% indicates a low overall likelihood of exploitation in the wild. It is not catalogued in CISA’s KEV list. Attackers who succeed can gain unrestricted access to all data managed by Oracle Identity Manager.

Generated by OpenCVE AI on August 4, 2026 at 01:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Oracle Identity Manager to the latest patched release that eliminates the OIM Legacy UI vulnerability.
  • Restrict HTTP access to the Oracle Identity Manager interfaces so that only trusted administrative users can reach the Legacy UI.
  • Enable and regularly review audit logging to detect any unauthorized creation or modification attempts.

Generated by OpenCVE AI on August 4, 2026 at 01:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 04 Aug 2026 01:45:00 +0000

Type Values Removed Values Added
Title Oracle Identity Manager Legacy UI Vulnerability Provides Unauthenticated Full Administrative Access

Sat, 01 Aug 2026 04:45:00 +0000

Type Values Removed Values Added
Title Oracle Identity Manager Legacy UI Vulnerability Provides Unauthenticated Full Administrative Access

Tue, 28 Jul 2026 19:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Administrative Access via Oracle Identity Manager Legacy UI

Fri, 24 Jul 2026 18:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Administrative Access via Oracle Identity Manager Legacy UI

Wed, 22 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 21 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
First Time appeared Oracle
Oracle identity Manager
CPEs cpe:2.3:a:oracle:identity_manager:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:identity_manager:14.1.2.1.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle identity Manager
References
Metrics cvssV3_1

{'score': 9.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'}

Subscriptions

Oracle Identity Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-08-01T03:56:03.714Z

Reserved: 2026-07-08T15:52:20.740Z

Link: CVE-2026-61197

cve-icon Vulnrichment

Updated: 2026-07-22T19:24:43.824Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T01:30:04Z

Weaknesses