CVE-2026-46810: Oracle Identity Manager Unauthenticated Access Control Vulnerability

Technical summary

CVE-2026-46810 is an improper access control vulnerability (CWE-284) in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0. The flaw exists in the End User Self Service component and permits unauthenticated network-based attacks through the IIOP protocol. Successful exploitation grants unauthorized read access to a subset of accessible Identity Manager data alongside unauthorized create, update, and delete operations. The vulnerability has a CVSS 3.1 score of 6.5 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, indicating low complexity exploitation with network-level accessibility.

Business impact

Identity Manager is a critical access governance and user provisioning platform. Compromise through this vulnerability could allow attackers to modify user accounts, permissions, or access rights without detection—potentially granting unauthorized system access or creating backdoors for persistent presence. Data breaches targeting user identities stored within Identity Manager could expose PII and credentials. While availability is not directly impacted, the integrity and confidentiality risks to identity data represent significant compliance and operational security concerns, especially in regulated industries requiring strict identity controls.

Affected systems

Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 are affected. Organizations running these specific versions of Identity Manager within their Oracle Fusion Middleware environment are at risk. Note that Oracle typically provides extended support for certain versions; verify your deployed version against the official Oracle product documentation to determine exposure.

Exploitability

This vulnerability is easily exploitable due to several factors: no authentication is required, network access via IIOP is typically available in enterprise deployments, and no user interaction is needed. The attack surface is broad in organizations where Identity Manager is internet-facing or accessible from untrusted networks. However, the attack does require knowledge of the IIOP protocol and target infrastructure, which limits exploitation to moderately skilled attackers or those with reconnaissance capabilities.

Remediation

Immediate action is to check whether your Organization runs affected versions 12.2.1.4.0 or 14.1.2.1.0 of Oracle Identity Manager. Contact Oracle directly or consult the latest Oracle Security Advisory for available patches and patched version numbers. Organizations should restrict network access to IIOP ports used by Identity Manager to trusted networks only, implement network segmentation, and monitor IIOP traffic for suspicious activity pending patch deployment. For versions in extended support beyond mainstream maintenance, custom backport patches may be required.

Patch guidance

Consult the official Oracle Security Advisory for CVE-2026-46810 to identify the correct patched version for your current release. Oracle typically provides either quarterly patches or critical patch updates (CPU). Test any patch in a staging environment that mirrors your production Identity Manager configuration before deployment, as Identity Manager patches can impact integrated systems and custom extensions. Plan downtime carefully given the centrality of Identity Manager to user access provisioning.

Detection guidance

Monitor IIOP protocol traffic to Identity Manager endpoints, particularly from external or untrusted network sources. Look for IIOP connections from unauthenticated sessions or unusual connection patterns. Audit Identity Manager logs for unauthorized data modifications, user account changes, or privilege escalations that lack corresponding admin activity. Enable security event logging at the application level if not already active. Consider deploying network-based intrusion detection signatures targeting exploitation attempts once available from your IDS vendor.

Why prioritize this

Although the CVSS score is medium (6.5), the practical risk is elevated because Identity Manager is an identity-critical system, the vulnerability requires no authentication, and successful exploitation directly compromises data integrity and confidentiality. The ease of exploitation combined with the sensitivity of identity data means this should be prioritized above generic CVSS scoring would suggest. Organizations with internet-exposed Identity Manager instances or those in regulated sectors should treat this as high priority.

Risk score, explained

The CVSS 3.1 base score of 6.5 reflects medium severity: network-accessible attack vector, low attack complexity, no authentication required, low integrity and confidentiality impact, and no availability impact. The score appropriately captures ease of exploitation but may underweight the business criticality of the affected system and the sensitivity of identity data at risk. Risk should be contextualized by the organization's reliance on Identity Manager, network topology, and compliance requirements.

Frequently asked questions