CVE-2026-46810: Medium severity Oracle Oracle Identity Manager vulnerability
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: End User Self Service). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Identity Manager. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Identity Manager accessible data as well as unauthorized read access to a subset of Identity Manager accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If IIOP is not required, disable the IIOP listener/service for Identity Manager to eliminate the network attack vector.
Oracle Identity Manager (End User Self Service) IIOP access = disabled - Compensating control
Restrict network access to the IIOP interface for Identity Manager at the network perimeter (firewall/ACL) to trusted management networks and known IPs; block access from untrusted networks and the public internet.
- Operational
Monitor and review Identity Manager and IIOP access logs for signs of unauthorized access or anomalous activity; investigate and respond to any suspected exploitation.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46810?
The severity of CVE-2026-46810 is medium with a score of 6.5.
Who is affected by CVE-2026-46810?
CVE-2026-46810 affects supported versions of Oracle Identity Manager, specifically 12.2.1.4.0 and 14.1.2.1.0.
How can I fix CVE-2026-46810?
To fix CVE-2026-46810, it is recommended to apply the latest security patches provided by Oracle for affected versions.
What type of attack can exploit CVE-2026-46810?
CVE-2026-46810 can be exploited by an unauthenticated attacker with network access via IIOP.
What are the potential impacts of CVE-2026-46810?
The potential impacts of CVE-2026-46810 include the compromise of Identity Manager functionalities.