Description
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-09-15
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

Oracle Identity Manager contains a vulnerability in its Security component that stems from missing authorization mechanisms (CWE‑269) and improper access control. The flaw allows an attacker with low privileges and network access via HTTP to execute arbitrary code, leading to a full takeover of the application and loss of confidentiality, integrity, and availability. The documented CVSS vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting a high impact from a network-facing attack.

Affected Systems

Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0, components of Oracle Fusion Middleware, are impacted by this vulnerability.

Risk and Exploitability

The base CVSS score of 8.8 indicates a severe threat, while the EPSS score of less than 1% shows a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. However, because exploitation requires only network connectivity over HTTP and no special privileges, an attacker who can reach the target could potentially compromise the system if mitigation steps are not applied.

Generated by OpenCVE AI on September 20, 2026 at 07:57 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Enforce strict role‑based access controls and audit authorization checks to mitigate missing authorization (CWE‑269).
  • Configure network firewalls or host‑based filtering to allow HTTP traffic to the Identity Manager only from trusted IP ranges and networks.
  • Disable or limit the HTTP exposure of the Identity Manager application by enabling HTTPS only and removing unused endpoints.

Generated by OpenCVE AI on September 20, 2026 at 07:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 08:15:00 +0000

Type Values Removed Values Added
Title Low-privilege HTTP Exploit in Oracle Identity Manager Enables Full Takeover

Fri, 18 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Title Low-Privilege Remote Code Execution Allowing Takeover in Oracle Identity Manager
Weaknesses CWE-284
CWE-95

Thu, 17 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-269
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 20:00:00 +0000

Type Values Removed Values Added
Title Low-Privilege Remote Code Execution Allowing Takeover in Oracle Identity Manager
Weaknesses CWE-284
CWE-95

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle identity Manager
CPEs cpe:2.3:a:oracle:identity_manager:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:identity_manager:14.1.2.1.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle identity Manager
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Identity Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-17T13:00:25.828Z

Reserved: 2026-08-31T15:40:57.353Z

Link: CVE-2026-83340

cve-icon Vulnrichment

Updated: 2026-09-17T12:59:26.959Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T20:18:47.360

Modified: 2026-09-17T14:17:42.500

Link: CVE-2026-83340

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T08:00:08Z

Weaknesses
  • CWE-269

    Improper Privilege Management