CVE-2026-35269: Oracle Identity Manager REST WebServices Authentication Bypass

Technical summary

CVE-2026-35269 is an improper access control vulnerability (CWE-284) in the REST WebServices component of Oracle Identity Manager. The flaw resides in request validation or authentication enforcement within the REST API layer, permitting unauthenticated HTTP requests to execute data modification operations. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) reflects network-exploitable attack surface, low complexity, no user interaction required, and high integrity impact. Confidentiality and availability are not directly impacted by this specific flaw.

Business impact

This vulnerability poses a direct threat to identity governance and access management operations. An attacker could perform unauthorized account provisioning, deprovisioning, or privilege escalation through data modification. Organizations relying on Identity Manager for employee lifecycle management, contractor access, or third-party entitlements face risk of unauthorized access grants, rogue administrator creation, or data corruption that could affect downstream systems consuming identity data. Remediation delays could enable persistent unauthorized access and complicate forensic investigation.

Affected systems

Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 are confirmed affected. Organizations running these versions in production should inventory all instances, including on-premises and cloud deployments. Version 14.1.2.1.0 is relatively recent, suggesting active deployments. Version 12.2.1.4.0 may be older but could still be in use in enterprise environments with slower patching cycles.

Exploitability

This vulnerability is easily exploitable. It requires only network access (no special positioning needed), HTTP protocol only, no authentication credentials, and no user interaction or social engineering. An attacker can discover instances via network scanning or reconnaissance and immediately attempt exploitation. The low complexity and lack of preconditions make this a high-priority attack vector for threat actors.

Remediation

Apply the security patch provided by Oracle for your specific Identity Manager version. Verify the patch details against the official Oracle Security Alert and test in a staging environment before production deployment. Ensure all instances—including development, test, and production environments—are patched, as attackers often target non-production systems for lateral movement.

Patch guidance

Consult the Oracle Security Alert issued on or around 2026-06-17 for the specific patch version and installation instructions for your Identity Manager release. Patches should be tested for compatibility with your environment before rollout. After patching, verify that REST WebServices authentication enforcement is active and that unauthenticated requests are properly rejected. Consider implementing compensating controls (network segmentation, API gateway authentication) if patching is delayed.

Detection guidance

Monitor REST API endpoints in Identity Manager for unauthenticated requests that succeed in modifying user accounts, roles, or entitlements. Log all HTTP requests to the REST WebServices component, including failures. Search historical logs for unauthenticated requests followed by account creation, modification, or deletion events. Implement network intrusion detection rules to flag unauthorized access attempts to Identity Manager REST endpoints. Review access control lists and recent privilege changes to identify potential unauthorized modifications dating back to when the system was deployed.

Why prioritize this

This vulnerability merits immediate prioritization due to its combination of easy exploitability, unauthenticated attack vector, and high-impact consequences. No credentials, complex setup, or user interaction are required. The integrity impact is severe—an attacker can corrupt or create identity data at scale. Identity Manager is often a critical trust boundary in enterprise security architecture; compromise here can enable privilege escalation, unauthorized access, and compliance violations. The lack of confidentiality or availability impact slightly reduces the CVSS score but does not diminish the operational risk.

Risk score, explained

CVSS 3.1 Base Score 7.5 (HIGH) reflects the attack vector (network-accessible), attack complexity (low), and lack of authentication requirements, combined with high integrity impact. The score does not account for organizational context—your risk may be higher if Identity Manager manages sensitive systems, highly privileged accounts, or regulated data. Environmental factors such as network exposure, monitoring capability, and compensating controls should be evaluated to determine organizational risk.

Frequently asked questions