CVE-2026-73942

An easily exploitable flaw in the OIM Legacy UI component of Oracle Identity Manager, part of Oracle Fusion Middleware, allows a low-privileged authenticated attacker with HTTP network access to fully compromise the OIM server. Successful attacks result in complete takeover of Oracle Identity Manager, with high impact on the confidentiality, integrity, and availability of the identity platform. Affected deployments are Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 where the Legacy UI is reachable by untrusted or low-trust users. Because OIM centrally manages user accounts and entitlements, compromise can cascade into unauthorized access across connected enterprise applications and directories. No public proof of concept is known and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, so exploitation is not confirmed in the wild.

What to do: Apply the Oracle Critical Patch Update (CPU) that remediates CVE-2026-73942 to all OIM 12.2.1.4.0 and 14.1.2.1.0 environments as soon as it is available. Until patched, restrict network access to the OIM Legacy UI to trusted admin networks, or disable the Legacy UI entirely if the modern interface meets operational needs. Review low-privileged OIM accounts and audit logs for anomalous privilege changes or account creation that could indicate an attempted takeover.