CVE-2026-35267: Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices)

Synopsis

An authenticated remote code execution (or full-compromise) vulnerability affects the REST WebServices component of Oracle Identity Manager, part of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0. The flaw is reachable over the network via HTTP and requires only a low-privilege account, with no victim interaction needed. Successful exploitation gives an attacker complete control over the Identity Manager instance, covering confidentiality, integrity, and availability. No fix version has been published by Oracle; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Identity Manager REST WebServices endpoint over the network via HTTP; the service must be exposed to the attacker's network segment.

• AuthenticationRequired

  A valid account is required, but any low-privilege user credential is sufficient; no administrative or elevated role is needed.

• Victim interactionNot required

  The attack is fully attacker-driven and does not require any action from a logged-in user or administrator.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• A successful attacker reads all data managed by Identity Manager, including user identities, credentials, roles, and access entitlements stored in the system.
• The attacker can modify or delete identity records, role assignments, and access policies, corrupting the authorization state across any downstream system that trusts Identity Manager.
• The attacker can crash or render the Identity Manager service unavailable, blocking authentication and provisioning workflows for dependent applications.
• Full system takeover is possible, meaning the attacker can pivot from the Identity Manager process to other resources reachable from the host.