CVE-2026-35268: Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Core)

Synopsis

A critical-severity authentication-bypass-to-takeover vulnerability affects Oracle Identity Manager (component: Core), versions 12.2.1.4.0 and 14.1.2.1.0. The flaw is reachable over the network via the T3 and IIOP protocols and requires only a low-privileged account, with no victim interaction needed. Successful exploitation gives an attacker full control over the Identity Manager instance, with scope change meaning the compromise can spill into additional products and systems beyond Identity Manager itself. No upstream fix version has been published yet; HarborGuard is tracking the advisory and will make a patched-image rebuild available the moment Oracle ships a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Identity Manager service over the network via the T3 or IIOP protocol; no local or physical access is needed.

• AuthenticationRequired

  A low-privileged account is sufficient; the attacker does not need administrative credentials, but some valid credential is required.

• Victim interactionNot required

  No user interaction is needed; the attacker can exploit the vulnerability entirely without involving another person.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race conditions, memory-layout knowledge, or other environmental preconditions.

Blast Radius

• Reads all data managed by Identity Manager, including stored credentials, user accounts, roles, and entitlement assignments.
• Modifies or deletes Identity Manager configuration, user records, and access policies, enabling privilege escalation across managed systems.
• Crashes or degrades the Identity Manager service, blocking authentication and provisioning workflows for dependent applications.
• Because the CVSS scope is changed, a successful attacker can pivot to other products and infrastructure that trust or integrate with Identity Manager.