CVE-2026-35267: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-35267 Overview

CVE-2026-35267 affects the REST WebServices component of Oracle Identity Manager, a core product within Oracle Fusion Middleware. The flaw allows a low-privileged attacker with network access via HTTP to compromise the Identity Manager instance. Successful exploitation results in full takeover of the affected system.

Oracle published this issue in the June 2026 Critical Patch Update. The vulnerability maps to CWE-306: Missing Authentication for a Critical Function, indicating that exposed REST endpoints fail to enforce required authentication checks.

Critical Impact
Successful exploitation grants attackers complete control over Identity Manager, putting downstream identity governance, provisioning workflows, and connected enterprise systems at risk.

Affected Products

Oracle Identity Manager 12.2.1.4.0
Oracle Identity Manager 14.1.2.1.0
Oracle Fusion Middleware deployments using the REST WebServices component

Discovery Timeline

2026-06-17 - CVE-2026-35267 published to NVD
2026-06-18 - Last updated in NVD database
June 2026 - Oracle releases fix in the Oracle Security Alert June 2026

Technical Details for CVE-2026-35267

Vulnerability Analysis

The vulnerability resides in the REST WebServices component of Oracle Identity Manager. An authenticated attacker with low privileges can reach the affected endpoints over HTTP and execute operations that should be restricted. Oracle classifies the issue as easily exploitable, with impacts spanning confidentiality, integrity, and availability.

Identity Manager governs user provisioning, role assignment, and access certification across enterprise systems. Compromise of this component cascades into the identity fabric. Attackers gaining takeover can create privileged accounts, alter access policies, and pivot into connected target systems such as Active Directory, databases, and SaaS platforms.

The attack does not require user interaction. The scope remains unchanged, meaning the impact is confined to the vulnerable component, but that component itself controls broad identity privileges across the enterprise.

Root Cause

The assignment of CWE-306 indicates that one or more REST endpoints fail to enforce authentication for a critical function. A low-privileged session token is sufficient to invoke operations that should be reserved for administrative roles. Oracle has not publicly disclosed the specific endpoint or function affected.

Attack Vector

The attacker sends crafted HTTP requests to the exposed REST WebServices interface of an Identity Manager deployment. Because exploitation requires only low privileges, any user with valid credentials, including service accounts or self-service portal users, can reach the vulnerable interface. No user interaction or local access is required. See the Oracle Security Alert June 2026 for vendor-specific technical details.

Detection Methods for CVE-2026-35267

Indicators of Compromise

Unexpected HTTP requests to /iam/governance/ or REST endpoints under the Identity Manager context root from low-privileged accounts.
New administrative accounts, role grants, or policy modifications in Identity Manager audit logs without a corresponding change request.
Provisioning events targeting downstream connectors that did not originate from approved workflows.
Authentication anomalies such as service accounts invoking REST APIs outside of expected schedules or source networks.

Detection Strategies

Enable verbose audit logging on Identity Manager REST WebServices and ship logs to a centralized analytics platform for correlation.
Baseline normal REST API usage per user and alert on deviations in endpoint, volume, or privilege escalation patterns.
Hunt for HTTP requests to administrative REST paths originating from accounts with no historical administrative activity.
Correlate Identity Manager activity with downstream changes in Active Directory, LDAP directories, and connected applications.

Monitoring Recommendations

Forward Oracle Fusion Middleware and WebLogic access logs to a SIEM and retain them for at least 90 days.
Monitor outbound connections from Identity Manager hosts for signs of lateral movement or data exfiltration.
Track changes to privileged roles, access policies, and connector configurations in near real time.
Alert on REST authentication failures followed by successful low-privileged calls to administrative endpoints.

How to Mitigate CVE-2026-35267

Immediate Actions Required

Apply the patches published in the Oracle Critical Patch Update for June 2026 to all Identity Manager 12.2.1.4.0 and 14.1.2.1.0 instances.
Inventory exposed Identity Manager REST endpoints and restrict network access to required management networks.
Rotate credentials for service accounts and administrators that interact with the REST WebServices interface.
Review audit logs for the past 90 days for unauthorized provisioning, role changes, or REST API calls.

Patch Information

Oracle addressed CVE-2026-35267 in the June 2026 Critical Patch Update. Administrators should consult the Oracle Security Alert June 2026 for patch identifiers and prerequisites. Apply patches in a staged environment first, then schedule production deployment based on exposure risk.

Workarounds

Place Identity Manager REST endpoints behind a reverse proxy or web application firewall that enforces strict authentication and IP allow-listing.
Disable or block external network access to the REST WebServices context if business workflows do not require it.
Tighten role assignments so that the minimum number of accounts hold any privilege capable of reaching the vulnerable endpoints.
Increase audit log verbosity and review frequency until the patch is deployed.

bash

# Example: restrict access to Identity Manager REST endpoints at the proxy layer
location /iam/governance/ {
    allow 10.10.0.0/24;       # management network only
    deny  all;
    proxy_pass http://oim-backend;
    proxy_set_header X-Forwarded-For $remote_addr;
}