CVE-2026-83401 in Identity Manager
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Identity Manager, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Identity Manager accessible data as well as unauthorized read access to a subset of Oracle Identity Manager accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Oracle Identity Manager product, specifically affecting its Legacy User Interface component in versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Fusion Middleware. This security flaw represents a significant risk to organizations relying on these specific releases for identity and access management operations. The core technical issue stems from insufficient validation or sanitization mechanisms within the legacy UI layer, which processes HTTP requests without adequate authentication checks in certain contexts. Because the vulnerability is located in this component, it exposes critical administrative and user data handling functions to external actors who can interact with the system over standard network protocols.
Exploitation of this flaw requires a unique set of conditions that blend technical accessibility with social engineering elements. An unauthenticated attacker must have network access to the target system via HTTP, allowing them to send crafted requests directly to the vulnerable endpoints. However, the attack is not fully automated; it demands human interaction from a victim other than the initial attacker. This typically implies that the vulnerability may be leveraged through cross-site scripting or similar techniques where an unsuspecting user must perform an action, such as clicking a malicious link or loading a compromised page while authenticated to Oracle Identity Manager. The requirement for this interactive element classifies the attack vector under CVSS criteria indicating low complexity but requiring user interaction, which significantly influences the overall risk profile and exploitation difficulty.
The operational impact of successfully exploiting this vulnerability is substantial due to its scope-changing nature. While the initial point of compromise is within Oracle Identity Manager, the consequences extend beyond that single application boundary. Successful attacks can lead to unauthorized read access for a subset of accessible data, exposing sensitive identity information such as user credentials, roles, and organizational structures. Furthermore, the attacker gains the ability to perform unauthorized updates, inserts, or deletes on other accessible data managed by the system. This dual impact on both confidentiality and integrity means that an adversary can not only steal critical identity data but also manipulate it, potentially altering access controls, creating backdoor accounts, or deleting essential audit trails. The CVSS 3.1 base score of 6.1 reflects this moderate-to-high severity, driven by the combination of network accessibility, lack of required authentication for initial vectoring, and the significant integrity impacts resulting from scope change to other products within the ecosystem.
From a classification perspective, this vulnerability aligns with CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-Site Scripting (XSS), particularly if the legacy UI fails to sanitize user-supplied input before rendering it in a web context. It also relates to CWE-284 regarding Improper Access Control, given that unauthenticated actors can trigger actions affecting data integrity. In terms of offensive security frameworks like MITRE ATT&CK, this vulnerability facilitates techniques associated with Initial Access through phishing or drive-by compromise if the human interaction element is exploited via social engineering, and subsequent Defense Evasion by manipulating identity stores to maintain persistence or escalate privileges within the broader IT environment.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary recommendation is to apply the latest security patches provided by Oracle for versions 12.2.1.4.0 and 14.1.2.1.0, which should contain fixes for the input validation flaws in the Legacy UI component. Organizations should also consider deprecating or disabling access to the legacy user interface if modern alternatives are available, thereby reducing the attack surface exposed over HTTP. Implementing strict network segmentation can limit direct internet-facing exposure of Oracle Identity Manager instances, ensuring that only authorized internal networks can reach these services. Additionally, deploying web application firewalls with rulesets tuned for detecting XSS and injection patterns may provide an additional layer of defense against exploitation attempts. Security awareness training is also critical to mitigate the human interaction requirement, as educating users on recognizing suspicious links or requests can prevent the final step needed for successful compromise.