CVE-2026-35265: Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Security)

Synopsis

An unspecified security flaw in the Security component of Oracle Identity Manager (versions 12.2.1.4.0 and 14.1.2.1.0) allows a low-privileged attacker to reach the service over HTTP and fully compromise the product. No authentication beyond a basic account is needed, and no victim interaction is required. Successful exploitation gives the attacker full control over the Identity Manager instance, including read, write, and denial-of-service capability. No fix version has been published by Oracle; HarborGuard is tracking the advisory and will make a patched rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Identity Manager service over the network via HTTP; no physical or local access is required.

• AuthenticationRequired

  Any valid low-privilege account is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  The attack completes without any action from a logged-in user or administrator.

• Attack complexityDetail

  The exploit is rated low complexity, meaning it is reliable and does not depend on race conditions or specific memory layout.

Blast Radius

• A successful attacker reads all data stored in Identity Manager, including user credentials, role assignments, entitlements, and audit logs.
• The attacker can modify or delete identity records, role assignments, and access policies across every managed system.
• The attacker can crash or render the Identity Manager service unavailable, blocking authentication and provisioning workflows for dependent applications.
• Because Identity Manager governs access to downstream systems, compromise enables lateral movement into any system whose access is brokered through it.