CVE-2026-73942: High severity Oracle Oracle Identity Manager vulnerability
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to Oracle Identity Manager (OIM Legacy UI) so only trusted clients can reach the HTTP interface, since the vulnerability is exploitable over HTTP (AV:N).
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker needs network access to Oracle Identity Manager over HTTP and a low-privileged account. No user interaction is required.
Which deployments are known to be affected?
The affected component is OIM Legacy UI in Oracle Identity Manager. Supported affected versions are 12.2.1.4.0 and 14.1.2.1.0.
What is the potential impact of successful exploitation?
Successful exploitation can result in takeover of Oracle Identity Manager, with high impact to confidentiality, integrity, and availability.