Description
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Published: 2026-10-20
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Compromise of Oracle Identity Manager, enabling full control over the system and exposing confidential data
Action: Immediate Patch
AI Analysis

Impact

A vulnerability in the REST WebServices component of Oracle Identity Manager allows a low‑privileged attacker, with only network access via HTTP, to compromise the entire application. Successful exploitation can lead to full takeover of the system, thereby impacting confidentiality, integrity and availability of all managed identities.

Affected Systems

Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 are affected. The flaw is present in the REST API layer that the application exposes for external interaction.

Risk and Exploitability

The vulnerability is rated CVSS 8.8 (High) and is considered easily exploitable. The EPSS score of <1% indicates a very low, but non‑zero, probability of exploitation, while the issue is not listed in the CISA KEV catalog. Exploitation requires only network access to the REST endpoint and a low‑privileged account, making the attack vector straightforward for adversaries with footholds in the same network.

Generated by OpenCVE AI on October 23, 2026 at 23:41 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the Oracle CPU Oct 2026 patch for Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 to remediate the REST API flaw
  • Restrict external network access to the Oracle Identity Manager REST endpoints to only trusted IP ranges or via VPN to limit exposure
  • Enforce strict least‑privilege roles on any accounts that can access the REST API, removing unnecessary permissions

Generated by OpenCVE AI on October 23, 2026 at 23:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 24 Oct 2026 00:00:00 +0000

Type Values Removed Values Added
Title Low‑Privilege REST API Vulnerability Enables Full Control of Oracle Identity Manager

Fri, 23 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Title Low‑Privilege REST API Vulnerability Enables Full Oracle Identity Manager Compromise
Weaknesses CWE-284

Fri, 23 Oct 2026 20:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-306
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Oracle Corporation
Oracle Corporation oracle Identity Manager
Vendors & Products Oracle Corporation
Oracle Corporation oracle Identity Manager

Wed, 21 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Title Low‑Privilege REST API Vulnerability Enables Full Oracle Identity Manager Compromise
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
First Time appeared Oracle
Oracle identity Manager
CPEs cpe:2.3:a:oracle:identity_manager:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:identity_manager:14.1.2.1.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle identity Manager
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Oracle Identity Manager
Oracle Corporation Oracle Identity Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-23T19:55:10.422Z

Reserved: 2026-09-14T22:10:16.633Z

Link: CVE-2026-91407

cve-icon Vulnrichment

Updated: 2026-10-23T19:55:04.671Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-20T22:20:44.040

Modified: 2026-11-03T16:34:26.787

Link: CVE-2026-91407

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T23:45:03Z

Weaknesses
  • CWE-306

    Missing Authentication for Critical Function