CVE-2026-35265: High severity Oracle Oracle Identity Manager vulnerability
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable HTTP access to Identity Manager if it is not required. If HTTP access is required, restrict access to only trusted management networks or hosts (for example require VPN access) and prefer secure channels.
Oracle Fusion Middleware - Identity Manager (Security) HTTP access = disabled or restricted to trusted hosts - Compensating control
Restrict network access to Identity Manager's HTTP ports at the network perimeter (firewall/ACL) to trusted IP addresses and/or place the service behind a web application firewall (WAF) to inspect and block malicious HTTP requests.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35265?
CVE-2026-35265 has a severity score of 8.8, classified as high.
How do I fix CVE-2026-35265?
To mitigate CVE-2026-35265, apply the latest security patches provided by Oracle for the affected versions of Identity Manager.
What versions are affected by CVE-2026-35265?
CVE-2026-35265 affects Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0.
What impact does CVE-2026-35265 have?
CVE-2026-35265 allows a low privileged attacker with network access to compromise the Oracle Identity Manager.
Is CVE-2026-35265 easily exploitable?
Yes, CVE-2026-35265 is considered easily exploitable as it can be targeted by attackers with low privileges via HTTP.