CVE-2026-35269: Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices)

Synopsis

An unauthenticated integrity-bypass vulnerability exists in the REST WebServices component of Oracle Identity Manager (versions 12.2.1.4.0 and 14.1.2.1.0). The flaw is reachable over HTTP from any network location and requires no credentials or victim interaction to trigger. Successful exploitation gives an attacker full ability to create, delete, or modify any data that Identity Manager can access, including critical identity and access records. No fix version has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Identity Manager REST WebServices endpoint over the network via HTTP; no local access or physical proximity is needed.

• AuthenticationNot required

  No credentials of any privilege level are required; the vulnerable endpoint is accessible to unauthenticated requests.

• Victim interactionNot required

  The attack is fully server-side and completes without any action from a logged-in user or administrator.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable, with no race conditions or environmental dependencies required to succeed.

Blast Radius

• Attacker creates new identity records or administrative accounts inside Identity Manager, enabling persistent unauthorized access.
• Attacker modifies existing user roles, entitlements, or access policies across any resource Identity Manager governs.
• Attacker deletes identity or access records, disrupting provisioning workflows and audit trails.
• All data accessible to Identity Manager is in scope for tampering, not just a subset of records.