Description
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Patch Immediately
AI Analysis

Impact

An Oracle Identity Manager vulnerability in the Legacy UI component allows a low‑privileged attacker with network access over HTTP to compromise the system. The flaw leads to a full takeover, exposing confidentiality, integrity, and availability. The problem is classified as a high‑severity, remote code execution weakness, indicated by a CVSS Base Score of 8.8.

Affected Systems

The affected products are Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0, part of Oracle Corporation’s Fusion Middleware suite. The vulnerability exists in the Legacy UI module and is specifically tied to the OIM web interface.

Risk and Exploitability

With a CVSS score of 8.8, the vulnerability presents a serious risk to any network user who can reach the Oracle Identity Manager web interface. The EPSS score is 0.00447, indicating a very low yet non‑zero probability of exploitation, and the CVE is not listed in CISA’s KEV catalog. The attack vector is clearly network‑based via HTTP, requiring only low privileged credentials or just the ability to access the UI. If exploited successfully, the attacker can execute arbitrary code and fully compromise the Identity Manager instance.

Generated by OpenCVE AI on October 28, 2026 at 01:37 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply Oracle’s security patch for CVE-2026-83403 as published in the October 2026 security alert
  • Restrict HTTP access to the Oracle Identity Manager Legacy UI to trusted IP ranges or VPN connections to limit exposure
  • If a patch cannot be applied immediately, disable the Legacy UI component or place the Identity Manager behind a firewall and monitor for anomalous HTTP activity

Generated by OpenCVE AI on October 28, 2026 at 01:37 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 28 Oct 2026 02:00:00 +0000

Type Values Removed Values Added
Title Oracle Identity Manager Legacy UI Allows Full Takeover via HTTP

Wed, 28 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title Remote Code Execution in Oracle Identity Manager Legacy UI via HTTP
Weaknesses CWE-20
CWE-94

Tue, 27 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle Corporation
Oracle Corporation oracle Identity Manager
Vendors & Products Oracle Corporation
Oracle Corporation oracle Identity Manager

Wed, 21 Oct 2026 07:00:00 +0000

Type Values Removed Values Added
Title Remote Code Execution in Oracle Identity Manager Legacy UI via HTTP
Weaknesses CWE-20
CWE-94

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle identity Manager
CPEs cpe:2.3:a:oracle:identity_manager:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:identity_manager:14.1.2.1.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle identity Manager
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Identity Manager
Oracle Corporation Oracle Identity Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-27T18:41:26.488Z

Reserved: 2026-08-31T15:40:57.357Z

Link: CVE-2026-83403

cve-icon Vulnrichment

Updated: 2026-10-27T18:40:17.780Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:19:56.883

Modified: 2026-11-03T16:35:05.963

Link: CVE-2026-83403

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T01:45:12Z

Weaknesses