CVE-2026-35267: High severity Oracle Oracle Identity Manager vulnerability

Published Jun 16, 2026

Updated

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Affected Software

3 affected components

Oracle Oracle Identity Manager=12.2.1.4.0, =14.1.2.1.0

Oracle Identity Manager=12.2.1.4.0

Oracle Identity Manager=14.1.2.1.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
If REST WebServices are not required, disable the REST WebServices component in Oracle Identity Manager configuration to remove the HTTP attack surface.
Oracle Identity Manager (REST WebServices) rest_webservices_enabled = false
Compensating control
Restrict network access to Oracle Identity Manager HTTP/REST endpoints to trusted administrative IPs or networks using firewalls, network ACLs, or a WAF to prevent remote exploitation over HTTP.
Operational
Monitor and investigate Oracle Identity Manager logs for signs of compromise. If compromise is suspected, isolate the system, rotate credentials, and restore from known-good backups.

Event History

Jun 16, 2026

CVE Published

via MITRE·07:26 PM

Data Sourced

via MITRE·07:26 PM

DescriptionSeverity

Jun 17, 2026

Data Sourced

via NVD·10:40 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-35267?

CVE-2026-35267 has a severity score of 8.8 which is classified as high.

How do I fix CVE-2026-35267?

To fix CVE-2026-35267, update Oracle Identity Manager to a version that is not affected, specifically later than 14.1.2.1.0.

Who is affected by CVE-2026-35267?

CVE-2026-35267 affects users of Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0.

What components are impacted by CVE-2026-35267?

CVE-2026-35267 impacts the REST WebServices component of Oracle Identity Manager.

What type of access is required to exploit CVE-2026-35267?

A low privileged attacker with network access via HTTP can exploit CVE-2026-35267.