CVE-2026-35267: Oracle Identity Manager REST WebServices Authentication Bypass (CVSS 8.8)

Technical summary

CVE-2026-35267 is a missing authentication or authorization check vulnerability (CWE-306) in Oracle Identity Manager's REST WebServices layer. The vulnerability has a CVSS 3.1 score of 8.8 (HIGH severity) with a network attack vector, low complexity, and low privilege requirements. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates that an authenticated user with minimal permissions can achieve high impact across confidentiality, integrity, and availability without user interaction. The affected versions are 12.2.1.4.0 and 14.1.2.1.0; organizations running other versions should verify their patch status against Oracle's advisory.

Business impact

Identity Manager is a cornerstone of enterprise access governance and single sign-on infrastructure. Complete compromise of this system exposes user credentials, enables unauthorized access provisioning, and can cascade across integrated applications and services. An attacker gaining control could perform unauthorized account creation, modify user permissions, extract sensitive identity data, or disable authentication services entirely—effectively disrupting business operations and breaching regulatory compliance obligations (SOC 2, ISO 27001, HIPAA, etc.). Recovery requires forensic investigation, credential rotation at scale, and potential re-provisioning of access across the entire organization.

Affected systems

Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 are directly affected. Customers running Oracle Fusion Middleware with Identity Manager components should immediately audit their deployed versions. Organizations using these versions for employee, contractor, or customer identity management are at risk. Downstream impact may extend to any system federated with or trusting Identity Manager for authentication and authorization decisions.

Exploitability

This vulnerability is easily exploitable. An attacker needs only low-privilege network credentials (e.g., a standard employee account or partner access) and HTTP access to the REST WebServices endpoint. No user interaction, special conditions, or advanced exploitation techniques are required. The low complexity and straightforward attack surface make this a high-probability exploit scenario in environments with standard network segmentation. Currently, the vulnerability is not on CISA's Known Exploited Vulnerabilities (KEV) catalog, but that status may change as visibility increases.

Remediation

Immediate patching is the primary remediation. Contact Oracle for availability of security patches for versions 12.2.1.4.0 and 14.1.2.1.0 and apply them as soon as possible. Pending patch deployment, implement network-level controls: restrict HTTP/HTTPS access to the REST WebServices endpoints to trusted IP ranges and authenticated network segments only. Enforce multi-factor authentication (MFA) for all Identity Manager administrative and API access. Monitor REST WebServices logs for anomalous low-privilege account activity, API calls with unexpected payloads, and privilege escalation attempts. Consider temporarily disabling unused REST WebServices endpoints.

Patch guidance

Verify the latest security patches from Oracle's official advisory for CVE-2026-35267. Patches should be applied first to non-production environments to validate compatibility with custom integrations and downstream systems. Identity Manager patches often require scheduled maintenance windows due to restart requirements; coordinate with stakeholder teams to minimize impact on authentication-dependent workflows. After patching, confirm the updated version in the Oracle Fusion Middleware administration console and re-run vulnerability scanning to verify remediation. Document patch application timestamps and tested configurations for audit and incident response purposes.

Detection guidance

Audit REST WebServices access logs for authentication bypass attempts or unusual low-privilege account activity targeting Identity Manager endpoints. Look for repeated failed authentication followed by successful API calls, requests to sensitive provisioning or credential endpoints from unexpected sources, or bulk user/role modifications initiated by service accounts. Enable verbose logging on REST WebServices components if not already active. Implement SIEM rules to flag any changes to user roles, permissions, or account status that lack corresponding audit trail entries. Network intrusion detection can alert on suspicious HTTP patterns to Identity Manager REST endpoints from internal network segments.

Why prioritize this

This vulnerability merits immediate prioritization (patch within days, not weeks) because: (1) Identity Manager controls access across the entire organization, making its compromise a critical escalation vector; (2) the attack requires only low privileges and standard network access—exploitability is high; (3) impact spans confidentiality, integrity, and availability simultaneously, affecting regulatory compliance; (4) there are no compensating controls that fully mitigate a REST WebServices layer flaw; (5) only two specific versions are documented as vulnerable, enabling quick scope definition and risk quantification.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects the combination of network-level exploitability with minimal privilege requirements and complete system compromise potential. The HIGH severity rating is justified by full impact to confidentiality (user credentials and identity data exposure), integrity (unauthorized modifications to users, roles, and permissions), and availability (potential service disruption or lockout). Organizations with business-critical reliance on Identity Manager and standard network trust models should treat this as a critical risk until patched. Industries with strict access governance mandates (finance, healthcare, government) face additional compliance and reputational harm.

Frequently asked questions