CVE-2026-73942 in Identity Manager
Summary
by MITRE • 09/15/2026
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/17/2026
The identified vulnerability resides within the Oracle Identity Manager product, specifically affecting its Legacy User Interface component in versions 12.2.1.4.0 and 14.1.2.1.0 of the Oracle Fusion Middleware suite. This security flaw is classified as a high-severity issue with a CVSS v3.1 base score of 8.8, indicating significant risk to confidentiality, integrity, and availability. The vulnerability stems from an architectural weakness in how the legacy UI handles authentication and authorization checks for specific endpoints or actions exposed via HTTP. Because the attack vector is network-based and requires no user interaction, it presents a direct remote exploitation path that does not rely on social engineering or client-side manipulation by end-users.
From a technical perspective, the flaw allows an attacker with low privileges to bypass critical security controls within the application logic. The absence of proper access control verification enables unauthorized entities to execute administrative functions or manipulate sensitive data structures intended for privileged users only. This misconfiguration effectively neutralizes the role-based access control mechanisms that are fundamental to identity management systems. Consequently, a malicious actor can escalate their permissions from a standard user level to full system administrator status without needing valid credentials for higher-privileged roles.
The operational impact of this vulnerability is severe due to the central role Oracle Identity Manager plays in enterprise security infrastructure. Successful exploitation leads to complete takeover of the application environment. An attacker gaining administrative access can modify identity policies, create backdoor accounts, exfiltrate sensitive user data including passwords and personal identifiable information, or disrupt service availability by deleting critical configuration objects. This compromise undermines the core trust model of the organization's identity governance framework, potentially leading to broader lateral movement within the network if these credentials are reused across other systems.
In terms of industry standard classifications, this vulnerability aligns with CWE-269 Improper Privilege Management and CWE-862 Missing Authorization. The exploitation technique corresponds to ATT&CK tactic T1078 Valid Accounts, specifically focusing on privilege escalation through misconfigured application roles rather than credential theft alone. It also touches upon T1548 Abuse Elevation Control Mechanism by exploiting flaws in the enforcement of security boundaries within the middleware layer. These mappings highlight that the root cause is not necessarily a code injection or buffer overflow but rather a logical failure in enforcing least-privilege principles at the application tier.
Mitigation strategies must prioritize immediate remediation given the high exploitability and network accessibility of the flaw. Oracle has released patches for affected versions, and administrators should apply the latest security updates to bring their installations up to date. In environments where patching is not immediately feasible, network segmentation controls such as firewall rules restricting HTTP access to the OIM server from untrusted networks can reduce the attack surface. Additionally, implementing Web Application Firewalls with specific rule sets designed to detect and block anomalous administrative requests or privilege escalation attempts can provide a layer of compensating control until the underlying code is fixed. Regular auditing of user privileges and review of authentication logs are also recommended to identify any signs of prior exploitation.