CVE-2026-83401: Medium severity Oracle Oracle Identity Manager vulnerability
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Identity Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Identity Manager accessible data as well as unauthorized read access to a subset of Oracle Identity Manager accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
The affected supported Oracle Identity Manager versions are 12.2.1.4.0 and 14.1.2.1.0, specifically the OIM Legacy UI component.
What does an attacker need to exploit this issue?
An unauthenticated attacker needs network access to the target over HTTP. Exploitation also requires human interaction by someone other than the attacker.
What access could a successful attacker gain?
A successful attack can provide unauthorized read access to a subset of Oracle Identity Manager-accessible data and unauthorized update, insert, or delete access to some such data. The impact may extend to additional products because the vulnerability has scope change.