CVE-2026-83402 in Identity Manager
Summary
by MITRE • 10/21/2026
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The identified vulnerability resides within the Oracle Identity Manager product, specifically affecting its Legacy User Interface component in versions 12.2.1.4.0 and 14.1.2.1.0 of the Oracle Fusion Middleware suite. This security flaw represents a critical risk to organizations relying on these specific releases for identity and access management operations. The vulnerability is characterized by an easily exploitable condition that allows attackers with low privileges and network access via HTTPS to compromise the integrity, confidentiality, and availability of the target system. Given the central role Oracle Identity Manager plays in managing user identities, authentication policies, and authorization workflows across enterprise environments, a successful exploitation can lead to complete takeover of the application server and potentially the underlying infrastructure it controls.
From a technical perspective, this vulnerability aligns with common patterns found in web-based identity management systems where improper access control or input validation mechanisms are present within legacy interface components. The ability for an attacker with low privileges to achieve full system compromise suggests that authentication checks may be bypassed or that sensitive administrative functions are accessible without sufficient privilege escalation controls. This type of flaw is often associated with CWE-284, Improper Access Control, where the application fails to enforce proper restrictions on authenticated users. Additionally, because the attack vector involves network access via HTTPS and requires no user interaction, it corresponds closely to ATT&CK technique T1078, Valid Accounts, indicating that attackers can leverage legitimate but insufficiently privileged credentials to gain unauthorized administrative control. The absence of a requirement for user interface manipulation further simplifies the exploitation process, allowing automated tools to target this weakness efficiently across large networks.
The operational impact of this vulnerability is severe, as indicated by its CVSS 3.1 Base Score of 8.8. A score in this range signifies high severity with significant impacts on all three pillars of information security: confidentiality, integrity, and availability. An attacker who successfully exploits this flaw can take over the Oracle Identity Manager instance, effectively gaining control over user accounts, roles, policies, and potentially sensitive personal data stored within the system. This could lead to unauthorized access to critical business applications that rely on Oracle Identity Manager for authentication, facilitating lateral movement within the network. Furthermore, the attacker may modify identity configurations to create backdoors or disable security logging, thereby obscuring their presence while maintaining persistent access. The availability impact implies that an attacker might also disrupt service by manipulating system states or triggering resource exhaustion conditions through malicious requests directed at the vulnerable interface.
To mitigate this risk, organizations running Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 must apply the latest security patches provided by Oracle as soon as possible. It is crucial to verify that all systems are updated to a version where this vulnerability has been remediated in both the legacy UI and any other affected components. In addition to patching, implementing network-level controls such as restricting access to the Identity Manager interface to trusted IP addresses or internal networks only can reduce the attack surface. Enforcing multi-factor authentication for administrative accounts adds an additional layer of protection against credential-based attacks. Regular vulnerability scanning and penetration testing should be conducted to identify any remaining exposure points. Security teams must also monitor logs for unusual activity patterns that might indicate attempted exploitation, such as repeated failed login attempts followed by successful privilege escalation events or unexpected changes in user roles and permissions within the identity management system.