Identity Manager vulnerabilities

37 known vulnerabilities in Identity Manager from Oracle. 37 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Oracle Identity Manager: Improper Authentication

  CVE-2026-91408Oct 20, 2026Oracle

  Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: End User Self Service). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with netwo

• 8.8 High severity

  Oracle Identity Manager: Missing Authentication for Critical Functionality

  CVE-2026-91407Oct 20, 2026Oracle

  Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network acc

• 8.8 High severity

  Oracle Identity Manager: Improper Authentication

  CVE-2026-91259Oct 20, 2026Oracle

  Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access

• 8.8 High severity

  Oracle Identity Manager: Improper Access Control

  CVE-2026-83403Oct 20, 2026Oracle

  Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access

• 8.8 High severity

  Oracle Identity Manager: Improper Access Control

  CVE-2026-83402Oct 20, 2026Oracle

  Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access

• 8.1 High severity

  Oracle Identity Manager: Improper Access Control

  CVE-2026-83422Sep 15, 2026Oracle

  Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network acces

• 9.8 Critical severity

  Oracle Identity Manager: Improper Authentication

  CVE-2026-83042Sep 15, 2026Oracle

  Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network acces

• 7.6 High severity

  Oracle Identity Manager: Improper Access Control

  CVE-2026-73943Sep 15, 2026Oracle

  Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network acces

• 8.8 High severity

  Oracle Identity Manager: Improper Access Control

  CVE-2026-73942Sep 15, 2026Oracle

  Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access

• 8.8 High severity

  Oracle Identity Manager: Improper Access Control

  CVE-2026-71047Sep 15, 2026Oracle

  Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP

• 8.8 High severity

  Oracle Identity Manager: Improper Access Control

  CVE-2026-70915Sep 15, 2026Oracle

  Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3,

• 9.8 Critical severity

  Oracle Identity Manager: Improper Authentication

  CVE-2026-70913Sep 15, 2026Oracle

  Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTT

• 7.8 High severity

  Oracle Identity Manager: Improper Access Control

  CVE-2026-71111Aug 18, 2026Oracle

  Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Installer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infra

• 8.8 High severity

  Oracle Identity Manager: Improper Access Control

  CVE-2026-61118Aug 18, 2026Oracle

  Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access

• 9.9 Critical severity

  Oracle Identity Manager: Improper Access Control

  CVE-2026-61066Aug 18, 2026Oracle

  Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access

• 9.8 Critical severity

  Oracle Identity Manager: Improper Access Control

  CVE-2026-60727Aug 18, 2026Oracle

  Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network acces

• 8.8 High severity

  Oracle Identity Manager: Missing Authentication for Critical Functionality

  CVE-2026-60722Aug 18, 2026Oracle

  Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access

• 9.8 Critical severity

  Oracle Identity Manager: Missing Authentication for Critical Functionality

  CVE-2026-60721Aug 18, 2026Oracle

  Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network acces

• 9.9 Critical severity

  Oracle Identity Manager: Missing Authentication for Critical Functionality

  CVE-2026-60720Aug 18, 2026Oracle

  Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access

• 8.8 High severity

  Oracle Identity Manager: Missing Authentication for Critical Functionality

  CVE-2026-60716Aug 18, 2026Oracle

  Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access

• 8.8 High severity

  Oracle Identity Manager: Improper Access Control

  CVE-2026-60715Aug 18, 2026Oracle

  Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access

• 8.7 High severity

  Oracle Identity Manager: Improper Access Control

  CVE-2026-60707Aug 18, 2026Oracle

  Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via

• 9.1 Critical severity

  Oracle Identity Manager: Improper Access Control

  CVE-2026-61197Jul 21, 2026Oracle

  Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network acces

• 9.8 Critical severity

  Oracle Identity Manager: Missing Authentication for Critical Functionality

  CVE-2026-61196Jul 21, 2026Oracle

  Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network acces

• 9.1 Critical severity

  Oracle Identity Manager: Improper Privilege Management

  CVE-2026-60567Jul 21, 2026Oracle

  Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network acces

• 8.1 High severity

  Oracle Identity Manager: Improper Access Control

  CVE-2026-60560Jul 21, 2026Oracle

  Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network acc

• 8.5 High severity

  Oracle Identity Manager: Improper Access Control

  CVE-2026-60330Jul 21, 2026Oracle

  Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows low privileged attacker with network acce

• 9.8 Critical severity

  Oracle Identity Manager: Missing Authentication for Critical Functionality

  CVE-2026-60329Jul 21, 2026Oracle

  Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network acces

• 8.1 High severity

  Oracle Identity Manager: Improper Access Control

  CVE-2026-60323Jul 21, 2026Oracle

  Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access

• 9.8 Critical severity

  Identity Manager: Missing Authentication for Critical Functionality

  CVE-2026-46807Jun 17, 2026Oracle

  Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T

• 9.9 Critical severity

  Identity Manager Connector: Improper Access Control

  CVE-2026-35294Jun 17, 2026Oracle

  Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: Mainframe Connectors). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with netw

• 7.5 High severity

  Identity Manager: Improper Access Control

  CVE-2026-35269Jun 17, 2026Oracle

  Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access vi

• 9.9 Critical severity

  Identity Manager: Improper Access Control

  CVE-2026-35268Jun 17, 2026Oracle

  Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to

• 8.8 High severity

  Identity Manager: Missing Authentication for Critical Functionality

  CVE-2026-35267Jun 17, 2026Oracle

  Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via

• 8.8 High severity

  Identity Manager: Missing Authentication for Critical Functionality

  CVE-2026-35265Jun 17, 2026Oracle

  Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Security). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to

• 9.8 Critical severity

  Oracle Identity Manager: Missing Authentication for Critical Functionality

  CVE-2026-21992Mar 20, 2026OracleEPSS 1.05%

  Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: REST WebServices) and Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). Supported versions that are affected are 12.2

• 9.8 Critical severity

  Oracle Fusion Middleware Missing Authentication for Critical Function Exploited

  CVE-2025-61757Oct 21, 2025OracleEPSS 88.6%

  Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access vi