CVE-2026-35269: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-35269 Overview

CVE-2026-35269 is a high-severity access control vulnerability in Oracle Identity Manager, a component of Oracle Fusion Middleware. The flaw resides in the REST WebServices component and affects versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access over HTTP can exploit the vulnerability without user interaction. Successful exploitation enables unauthorized creation, deletion, or modification of critical data accessible to Identity Manager. Oracle published the issue in its June 2026 Critical Patch Update.

Critical Impact
An unauthenticated remote attacker can tamper with identity data, including account creation, deletion, and modification, undermining identity governance across the enterprise.

Affected Products

Oracle Identity Manager 12.2.1.4.0
Oracle Identity Manager 14.1.2.1.0
Oracle Fusion Middleware (REST WebServices component)

Discovery Timeline

2026-06-17 - CVE-2026-35269 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database
June 2026 - Oracle releases fix in the Critical Patch Update (Oracle Security Alert)

Technical Details for CVE-2026-35269

Vulnerability Analysis

The vulnerability is classified under [CWE-284] Improper Access Control. It exists in the REST WebServices component of Oracle Identity Manager, the identity governance and administration product in Oracle Fusion Middleware. The affected REST endpoints fail to enforce authentication or authorization checks for operations that alter identity data. As a result, an attacker reachable over HTTP can issue requests that create, delete, or modify identity records.

The CVSS vector indicates that only integrity is affected, with no impact on confidentiality or availability. However, integrity loss in an identity management platform carries downstream consequences. An attacker can provision rogue accounts, escalate privileges by modifying group memberships, or remove legitimate users to disrupt operations. Identity Manager often acts as the authoritative source for downstream applications, so unauthorized modifications can propagate across connected systems.

Root Cause

The root cause is missing or insufficient access control enforcement on REST API endpoints exposed by Identity Manager. Requests that modify identity objects are processed without verifying the caller's authentication context or entitlements. Oracle's advisory describes the issue as easily exploitable with no privileges required.

Attack Vector

The attack vector is network-based over HTTP. The attacker requires no credentials, no user interaction, and no prior foothold. Any system with network reachability to the Identity Manager REST WebServices interface can submit crafted requests to perform unauthorized write operations. EPSS data places exploitation probability at approximately 0.35%, but the low attack complexity and unauthenticated nature warrant priority remediation.

No public proof-of-concept exploit has been published, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog at this time. Technical details beyond the Oracle advisory are not publicly available; refer to the Oracle Security Alert for vendor-supplied information.

Detection Methods for CVE-2026-35269

Indicators of Compromise

Unexpected account creation, deletion, or attribute modification events in Oracle Identity Manager audit logs, especially from unauthenticated sessions or unfamiliar source IPs.
HTTP requests to Identity Manager REST endpoints under /iam/governance/ or /idmui/ paths originating from external or non-administrative networks.
Sudden changes to role assignments, group memberships, or entitlement grants without an associated approved workflow ticket.

Detection Strategies

Inspect Identity Manager access logs for REST API calls returning HTTP 200 responses on write operations where no authenticated principal is associated with the session.
Correlate identity provisioning events against change management tickets to surface unauthorized modifications.
Deploy web application firewall (WAF) rules that flag unauthenticated POST, PUT, or DELETE requests to Identity Manager REST WebServices endpoints.

Monitoring Recommendations

Forward Oracle Identity Manager audit and access logs to a centralized SIEM or data lake for retention and analytics.
Establish a baseline of normal provisioning volume and alert on statistical deviations in account create or delete operations.
Monitor downstream connected systems for unexpected account synchronization events that may indicate upstream tampering in Identity Manager.

How to Mitigate CVE-2026-35269

Immediate Actions Required

Apply the patches from the Oracle June 2026 Critical Patch Update to all Identity Manager 12.2.1.4.0 and 14.1.2.1.0 deployments without delay.
Restrict network access to the Identity Manager REST WebServices interface to trusted management networks only.
Audit recently created, modified, and deleted identity objects to identify any unauthorized changes that predate patching.

Patch Information

Oracle addressed CVE-2026-35269 in the June 2026 Critical Patch Update. Administrators should review the Oracle Security Alert for the specific patch bundles applicable to their Identity Manager version and apply them following Oracle's documented procedures. Test patches in a non-production environment before rolling out to production identity governance systems.

Workarounds

Place Identity Manager REST endpoints behind a reverse proxy or WAF that enforces authentication before requests reach the application.
Disable or block unused REST WebServices endpoints if they are not required for business operations.
Apply network segmentation and IP allowlisting to limit which hosts can reach the Identity Manager management interfaces.

bash

# Example: restrict access to Identity Manager REST endpoints via reverse proxy
# Apache httpd snippet enforcing source IP allowlist
<Location "/iam/governance/">
    Require ip 10.10.20.0/24
    Require ip 10.10.30.0/24
</Location>