CVE-2026-35268: Critical severity Oracle Oracle Identity Manager vulnerability
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Identity Manager. While the vulnerability is in Identity Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable T3 and IIOP listeners if not required. If they are required, restrict access so the listeners are only reachable from trusted management networks or specific IP addresses and not exposed to general network access. Apply these changes to affected deployments (notably versions 12.2.1.4.0 and 14.1.2.1.0).
Oracle Identity Manager (Fusion Middleware Core) T3 and IIOP network access = disabled or restricted to trusted hosts - Compensating control
At the network edge and host firewalls, block or restrict T3 and IIOP traffic to Identity Manager hosts (allow only trusted IPs). Segment Identity Manager hosts from other production networks and deploy IDS/IPS/WAF rules to detect and block exploitation attempts targeting T3/IIOP protocols.
- Operational
Assume a potential compromise is possible (successful attacks can result in takeover). Audit logs for suspicious activity, isolate any suspected compromised hosts, and rotate credentials and secrets associated with Identity Manager and any integrated systems.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35268?
The severity of CVE-2026-35268 is rated as critical with a score of 9.9.
How do I fix CVE-2026-35268?
To fix CVE-2026-35268, update to the latest patched version of Oracle Identity Manager as recommended by Oracle.
What are the affected versions of CVE-2026-35268?
The affected versions for CVE-2026-35268 are 12.2.1.4.0 and 14.1.2.1.0 of Oracle Identity Manager.
Who is impacted by CVE-2026-35268?
CVE-2026-35268 primarily impacts organizations using vulnerable versions of Oracle Identity Manager that are accessible over the network.
What type of attack does CVE-2026-35268 facilitate?
CVE-2026-35268 facilitates an easily exploitable attack allowing a low privileged attacker with network access to compromise the Identity Manager.