CVE-2026-35268: Oracle Identity Manager Privilege Escalation

CVE-2026-35268 Overview

CVE-2026-35268 is a critical vulnerability in the Core component of Oracle Identity Manager, part of Oracle Fusion Middleware. The flaw allows a low-privileged attacker with network access through the T3 or IIOP protocols to fully compromise Identity Manager. Because the vulnerability involves a scope change, successful exploitation can impact products beyond Identity Manager itself. Oracle published the fix as part of the June 2026 Critical Security Patch Update. The vulnerability is categorized under [CWE-284] (Improper Access Control) and carries a CVSS 3.1 Base Score of 9.9.

Critical Impact
A low-privileged remote attacker can take over Oracle Identity Manager through T3 or IIOP, with confirmed scope change affecting additional Fusion Middleware components.

Affected Products

Oracle Identity Manager 12.2.1.4.0
Oracle Identity Manager 14.1.2.1.0
Oracle Fusion Middleware (Core component)

Discovery Timeline

2026-06-17 - CVE-2026-35268 published to NVD
2026-06-18 - Last updated in NVD database
June 2026 - Oracle releases fix in the Oracle Critical Security Patch Update

Technical Details for CVE-2026-35268

Vulnerability Analysis

The vulnerability resides in the Core component of Oracle Identity Manager, an enterprise identity governance product within Oracle Fusion Middleware. An authenticated attacker holding only low-level privileges can exploit the flaw over the network. The attack surface is the T3 and IIOP remote protocols exposed by the underlying WebLogic Server.

Successful exploitation results in complete takeover of the Identity Manager instance. The CVSS vector indicates a scope change, meaning compromise extends beyond Identity Manager into adjacent systems that rely on it for authentication and authorization. Confidentiality, integrity, and availability are all fully impacted.

Identity Manager governs user provisioning, role administration, and credential lifecycle across enterprise applications. Takeover of this component effectively grants the attacker control over identity infrastructure connected to it. Oracle has not disclosed the underlying technical root cause beyond classifying the issue under improper access control.

Root Cause

The root cause is improper access control [CWE-284] in the Core component handling requests over T3 and IIOP. These remote protocols allow Java clients to interact with WebLogic services. Insufficient authorization checks permit a low-privileged caller to invoke functionality reserved for administrative users.

Attack Vector

The attack originates from the network. An attacker authenticates with low privileges and issues crafted T3 or IIOP requests against the Identity Manager listener. No user interaction is required, and exploitation complexity is low. The scope change indicated by the CVSS vector reflects that the compromised component executes actions affecting other security authorities.

No verified public proof-of-concept code is currently available. See the Oracle Security Alert for vendor-supplied details.

Detection Methods for CVE-2026-35268

Indicators of Compromise

Unexpected T3 or IIOP connections to Identity Manager listeners from non-administrative sources or external networks.
New administrative accounts, role assignments, or provisioning rules in Identity Manager that do not match approved change records.
WebLogic server logs showing unusual deserialization activity, class loading from unexpected paths, or stack traces involving weblogic.rjvm or oracle.iam packages.
Outbound connections from the Identity Manager host to unfamiliar destinations following inbound T3/IIOP traffic.

Detection Strategies

Monitor authentication and authorization audit logs in Identity Manager for low-privileged accounts performing administrative operations.
Inspect WebLogic access logs for T3 (t3://) and IIOP (iiop://) requests originating from non-trusted network segments.
Correlate identity provisioning events with the originating user session and source IP to surface anomalous activity.

Monitoring Recommendations

Forward WebLogic, Identity Manager audit, and host-level telemetry to a centralized SIEM for cross-source correlation.
Baseline normal T3/IIOP traffic patterns and alert on deviations in source, volume, or invoked operations.
Track changes to privileged roles, connectors, and scheduled tasks in Identity Manager and alert on additions outside approved windows.

How to Mitigate CVE-2026-35268

Immediate Actions Required

Apply the Oracle Critical Patch Update for June 2026 to all Identity Manager instances running 12.2.1.4.0 or 14.1.2.1.0.
Restrict network access to the T3 and IIOP listeners so they are reachable only from trusted management hosts.
Audit Identity Manager accounts, roles, and recent administrative actions for signs of abuse prior to patching.
Rotate credentials and API keys associated with Identity Manager service accounts after patching if compromise is suspected.

Patch Information

Oracle addressed CVE-2026-35268 in the June 2026 Critical Security Patch Update. Refer to the Oracle Security Alert for patch identifiers, prerequisites, and installation guidance. Both 12.2.1.4.0 and 14.1.2.1.0 require the corresponding patch bundle.

Workarounds

Use a WebLogic connection filter to deny T3 and IIOP traffic from untrusted networks. Configure weblogic.security.net.ConnectionFilterImpl to allow only required source ranges.
Place Identity Manager behind a network segment that blocks inbound T3 and IIOP at the firewall, exposing only HTTPS administrative interfaces.
Disable IIOP in the WebLogic Server configuration if it is not required by integrated applications.

bash

# Example WebLogic connection filter rules (config.xml)
# Allow T3/IIOP from admin subnet only; deny elsewhere
10.10.20.0/24  *  *  allow  t3 t3s iiop iiops
0.0.0.0/0      *  *  deny   t3 t3s iiop iiops