CVE-2026-70915: High severity Oracle Oracle Identity Manager vulnerability
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
The affected supported versions are Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0, specifically the Core component.
What access does an attacker need?
An attacker needs network access to the Oracle Identity Manager instance through T3 or IIOP and only low-privileged credentials. No user interaction is required.
What is the potential impact of successful exploitation?
Successful exploitation can result in takeover of Oracle Identity Manager, with high impact to confidentiality, integrity, and availability.