Description
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Full compromise of Oracle Identity Manager via low‑privilege HTTP access
Action: Immediate Patch
AI Analysis

Impact

A vulnerability in the legacy UI component of Oracle Identity allows an attacker who has low privileges and network access over HTTP to gain full control of the system. The attacker can read, modify, and delete data and potentially alter system configuration, resulting in complete loss of confidentiality, integrity, and availability for the application.

Affected Systems

The flaw impacts Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0, which are distributed as part of Oracle Fusion Middleware.

Risk and Exploitability

The CVSS 3.1 base score of 8.8 reflects a high‑severity threat. The EPSS score of < 1% indicates a very low exploitation probability, but the attack vector is straightforward – via plain HTTP – and requires only low privilege credentials, making the vulnerability easily exploitable. The vulnerability is not currently listed in CISA’s KEV catalog, but the high severity warrants urgent remediation.

Generated by OpenCVE AI on October 29, 2026 at 00:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle Identity Manager security patch released in the Oct 2026 update.
  • Limit HTTP access to the OIM web interface by configuring firewall rules and allowing traffic only from trusted IP addresses.
  • Enforce least‑privilege and role‑based access control for all OIM accounts to reduce the impact of any compromised credentials.

Generated by OpenCVE AI on October 29, 2026 at 00:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 29 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Access Enables Complete Compromise of Oracle Identity Manager

Wed, 28 Oct 2026 23:45:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Exploit Allowing Full Control of Oracle Identity Manager
Weaknesses CWE-284

Wed, 28 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-287

Fri, 23 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
First Time appeared Oracle Corporation
Oracle Corporation oracle Identity Manager
Vendors & Products Oracle Corporation
Oracle Corporation oracle Identity Manager

Wed, 21 Oct 2026 08:30:00 +0000

Type Values Removed Values Added
Title Low-Privilege HTTP Exploit Allowing Full Control of Oracle Identity Manager
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle identity Manager
CPEs cpe:2.3:a:oracle:identity_manager:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:identity_manager:14.1.2.1.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle identity Manager
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Identity Manager
Oracle Corporation Oracle Identity Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T20:37:22.895Z

Reserved: 2026-09-14T22:10:16.619Z

Link: CVE-2026-91259

cve-icon Vulnrichment

Updated: 2026-10-28T20:37:13.010Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:26.883

Modified: 2026-11-03T16:34:45.743

Link: CVE-2026-91259

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T00:30:14Z

Weaknesses