CVE-2026-35265: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-35265 Overview

CVE-2026-35265 affects the Security component of Oracle Identity Manager, part of Oracle Fusion Middleware. The flaw allows a low-privileged attacker with network access via HTTP to compromise the product and achieve full takeover. Oracle addressed the issue in the June 2026 Critical Patch Update. The weakness maps to [CWE-306] Missing Authentication for Critical Function, indicating that protected functionality is reachable without proper credential validation. Confidentiality, integrity, and availability are all impacted on successful exploitation.

Critical Impact
A low-privileged remote attacker can take over Oracle Identity Manager, gaining control of identity provisioning, role assignment, and downstream account governance across the enterprise.

Affected Products

Oracle Identity Manager 12.2.1.4.0
Oracle Identity Manager 14.1.2.1.0
Oracle Fusion Middleware deployments embedding the affected Identity Manager versions

Discovery Timeline

2026-06-17 - CVE-2026-35265 published to the National Vulnerability Database
2026-06-18 - Last updated in NVD database
June 2026 - Oracle releases fix in the Oracle Critical Security Patch Update

Technical Details for CVE-2026-35265

Vulnerability Analysis

The vulnerability resides in the Security component of Oracle Identity Manager. An authenticated user with only low-level privileges can send crafted HTTP requests that reach functionality intended for higher-privileged operators. Because authentication for a critical function is missing or improperly enforced, the server processes those requests and grants the attacker effective control of Identity Manager.

Oracle Identity Manager governs user provisioning, role lifecycle, and access certifications across connected systems. Takeover of Identity Manager therefore extends beyond the application itself. An attacker can create privileged accounts, alter approval workflows, and propagate access into target systems integrated with the identity platform.

No authenticated proof-of-concept or public exploit is currently catalogued, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Oracle's advisory characterizes the flaw as easily exploitable, which raises the likelihood of weaponization once technical details circulate.

Root Cause

The root cause is classified as [CWE-306] Missing Authentication for a Critical Function. A code path within the Identity Manager Security component exposes sensitive operations to requests that carry only a basic authenticated session, rather than requiring administrative authentication or authorization checks tied to the operation being performed.

Attack Vector

The attack vector is network-based over HTTP. The attacker must hold a low-privileged account on the target Identity Manager instance. From there, the attacker issues HTTP requests against the vulnerable endpoint in the Security component, bypassing the authentication required for privileged operations and pivoting to full administrative control.

Exploitation does not require user interaction and does not depend on chaining with other vulnerabilities. Internet-exposed Identity Manager consoles and self-service portals are the highest-risk deployment patterns.

Detection Methods for CVE-2026-35265

Indicators of Compromise

Unexpected creation of administrative or system accounts inside Oracle Identity Manager
Modification of role definitions, approval policies, or access policies by non-administrative users
HTTP requests to Identity Manager privileged endpoints originating from accounts that historically only used self-service paths
New or altered connectors and integration bindings to downstream target systems

Detection Strategies

Enable verbose audit logging in Oracle Identity Manager and forward events to a centralized log platform for correlation
Baseline the normal set of users who invoke administrative APIs, then alert on deviations from that baseline
Correlate WebLogic access logs with Identity Manager audit events to identify HTTP requests reaching privileged paths from low-privileged sessions

Monitoring Recommendations

Monitor Identity Manager oim-config and policy store changes for unauthorized modifications
Track privileged role grants and orchestration events for anomalies in timing or initiator identity
Alert on configuration export, scheduler job creation, and plugin uploads performed outside change windows

How to Mitigate CVE-2026-35265

Immediate Actions Required

Apply the June 2026 Oracle Critical Patch Update for Oracle Fusion Middleware to all affected Identity Manager instances
Restrict network access to Identity Manager administrative endpoints to trusted management networks
Review recently created accounts, role grants, and policy changes for signs of abuse
Rotate credentials and API keys for accounts integrated with Identity Manager if compromise is suspected

Patch Information

Oracle published fixes in the June 2026 Critical Patch Update. Refer to the Oracle Security Alert for patch identifiers, prerequisites, and bundle dependencies for versions 12.2.1.4.0 and 14.1.2.1.0. Apply the patch on a non-production environment first to validate connector and customization compatibility.

Workarounds

Place Identity Manager behind a reverse proxy or WAF that restricts privileged URL paths to administrator source IP ranges
Disable or quarantine low-privileged self-service accounts that are not actively required until patching is complete
Increase audit retention and review frequency for the Security component until the patch is deployed

bash

# Example: restrict access to OIM administrative paths at the reverse proxy
# (Apache httpd snippet - adapt path prefix to your deployment)
<LocationMatch "^/(identity|sysadmin|iam/governance)">
    Require ip 10.20.30.0/24
    Require ip 10.20.31.0/24
</LocationMatch>