Description
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Identity Manager. While the vulnerability is in Oracle Identity Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Identity Manager accessible data as well as unauthorized update, insert or delete access to some of Oracle Identity Manager accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N).
Published: 2026-09-15
Score: 7.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Data Access
Action: Patch
AI Analysis

Impact

Oracle Identity Manager’s Legacy UI contains an access control flaw that permits an attacker with high privileges and network access via HTTP to read, modify, or delete data that should be protected. This flaw can grant an adversary full access to critical identity data, leading to potential compromise of other connected systems if the authority scope is broadened.

Affected Systems

The vulnerability exists in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 and targets the Legacy UI component of the Oracle Fusion Middleware suite.

Risk and Exploitability

The CVSS base score of 7.6 denotes a high impact on confidentiality, with a low integrity effect. The EPSS score of less than 1% indicates a very low current exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Nonetheless, the attack vector is network‑based (HTTP) and requires an attacker with high privileges. Successful exploitation could lead to unauthorized data access or full compromise of all Identity Manager accessible data.

Generated by OpenCVE AI on September 20, 2026 at 12:00 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch for OIM Legacy UI in versions 12.2.1.4.0 and 14.1.2.1.0 as soon as it is released
  • Restrict HTTP access to the Identity Manager to trusted networks or VPNs using firewall rules or network segmentation
  • Enforce strict least‑privilege access policies and enable multi‑factor authentication for all Identity Manager accounts
  • Continuously monitor logs for anomalous access patterns or unauthorized data modifications

Generated by OpenCVE AI on September 20, 2026 at 12:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Title Unauthorized Access in Oracle Identity Manager Legacy UI

Thu, 17 Sep 2026 06:30:00 +0000

Type Values Removed Values Added
Title Unauthorized Access in Oracle Identity Manager Legacy UI

Wed, 16 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Identity Manager. While the vulnerability is in Oracle Identity Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Identity Manager accessible data as well as unauthorized update, insert or delete access to some of Oracle Identity Manager accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N).
First Time appeared Oracle
Oracle identity Manager
CPEs cpe:2.3:a:oracle:identity_manager:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:identity_manager:14.1.2.1.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle identity Manager
References
Metrics cvssV3_1

{'score': 7.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N'}

Subscriptions

Oracle Identity Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-16T16:30:19.362Z

Reserved: 2026-08-13T18:41:45.892Z

Link: CVE-2026-73943

cve-icon Vulnrichment

Updated: 2026-09-16T15:08:08.454Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-15T20:17:45.310

Modified: 2026-09-22T19:51:21.647

Link: CVE-2026-73943

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T12:00:13Z

Weaknesses