Description
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Identity Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Identity Manager accessible data as well as unauthorized read access to a subset of Oracle Identity Manager accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Published: 2026-10-20
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized data modification or read via unauthenticated HTTP access
Action: Immediate Patch
AI Analysis

Impact

The vulnerability exists in the Oracle Identity Manager Legacy UI component. It allows an unauthenticated attacker who can communicate over HTTP to gain unauthorized access to the system and perform update, insert, or delete operations on data, as well as read a subset of data. The impact is mainly confidentiality and integrity, with no availability impact. The weakness appears to be an improper access control that permits operations without proper authentication.

Affected Systems

Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 on Oracle Fusion Middleware are affected. The issue resides in the OIM Legacy UI, which is part of the broader Identity Manager platform.

Risk and Exploitability

The CVSS 3.1 base score of 6.1 indicates a moderate severity. The attacker requires network access to the victim’s HTTP interface and no credentials, but a human interaction from a user other than the attacker is necessary to complete the attack. The exploit may also lead to scope changes impacting additional Oracle products. EPSS is not available and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog, so the known exploitation likelihood is uncertain.

Generated by OpenCVE AI on October 21, 2026 at 06:36 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle security patch provided in the CPU October 2026 advisory (https://www.oracle.com/security-alerts/cpuoct2026.html) to update affected Oracle Identity Manager components.
  • If the Legacy UI component is not required for business operations, disable or remove it from the Oracle Identity Manager installation to eliminate the attack surface.
  • Restrict incoming HTTP traffic to the Oracle Identity Manager servers to trusted networks or VPN connections only, thereby limiting exposure.
  • Enable comprehensive logging on Oracle Identity Manager and monitor for unauthorized data modification or read attempts, and investigate any anomalous activity promptly.

Generated by OpenCVE AI on October 21, 2026 at 06:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle Corporation
Oracle Corporation oracle Identity Manager
Vendors & Products Oracle Corporation
Oracle Corporation oracle Identity Manager

Wed, 21 Oct 2026 07:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated HTTP Exploit in Oracle Identity Manager Legacy UI Allows Unauthorized Data Modification
Weaknesses CWE-284
CWE-285

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Identity Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Identity Manager accessible data as well as unauthorized read access to a subset of Oracle Identity Manager accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
First Time appeared Oracle
Oracle identity Manager
CPEs cpe:2.3:a:oracle:identity_manager:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:identity_manager:14.1.2.1.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle identity Manager
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Oracle Identity Manager
Oracle Corporation Oracle Identity Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T18:37:17.612Z

Reserved: 2026-08-31T15:40:57.357Z

Link: CVE-2026-83401

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:19:56.660

Modified: 2026-11-03T16:35:40.277

Link: CVE-2026-83401

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T18:30:09Z

Weaknesses