CVE-2026-46807: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-46807 Overview

CVE-2026-46807 is a critical authentication bypass vulnerability in the Oracle Identity Manager component of Oracle Fusion Middleware. The flaw resides in the OIM Legacy UI and allows unauthenticated attackers with network access via the T3 or IIOP protocols to compromise Identity Manager. Successful exploitation results in full takeover of the Identity Manager instance, impacting confidentiality, integrity, and availability. The vulnerability is classified under [CWE-306] (Missing Authentication for Critical Function) and affects Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0. Oracle addressed the issue in the June 2026 Critical Patch Update.

Critical Impact
Unauthenticated remote attackers can take over Oracle Identity Manager, gaining control of identity infrastructure and downstream provisioned systems.

Affected Products

Oracle Identity Manager 12.2.1.4.0
Oracle Identity Manager 14.1.2.1.0
Oracle Fusion Middleware (OIM Legacy UI component)

Discovery Timeline

2026-06-17 - CVE-2026-46807 published to NVD
2026-06-17 - Last updated in NVD database
June 2026 - Oracle releases security patch via Oracle Critical Patch Update Advisory

Technical Details for CVE-2026-46807

Vulnerability Analysis

The vulnerability resides in the OIM Legacy UI component of Oracle Identity Manager. Attackers can reach the affected code path remotely through the T3 and Internet Inter-ORB Protocol (IIOP) interfaces exposed by the underlying WebLogic Server. These protocols are commonly used for remote method invocation in Oracle middleware deployments and are frequently reachable in internal enterprise networks.

Exploitation requires no authentication, no user interaction, and low attack complexity. A successful attack yields complete takeover of Identity Manager, meaning the attacker can read, modify, and delete identity data, manipulate user accounts, and pivot into systems that Identity Manager provisions. Because Identity Manager governs identity lifecycle across enterprise applications, compromise has cascading effects across Active Directory, databases, and SaaS connectors integrated with OIM.

Root Cause

The root cause is missing authentication for a critical function [CWE-306] reachable through Oracle's T3 and IIOP remoting protocols. The OIM Legacy UI component exposes functionality that should require authenticated, authorized callers but accepts unauthenticated requests over these binary protocols. Historically, T3 and IIOP have been a recurring attack surface in Oracle Fusion Middleware due to deserialization and unauthenticated method access on remotely accessible endpoints.

Attack Vector

An attacker with network reachability to the WebLogic T3 (7001/tcp by default) or IIOP listener can send crafted protocol messages targeting the vulnerable Identity Manager component. No valid credentials are required. The technical details of the exploitation primitive have not been publicly disclosed by Oracle, and no public proof-of-concept is available at the time of writing. See the Oracle Security Alert for advisory details.

// No verified exploit code available.
// Refer to the Oracle June 2026 Critical Patch Update advisory for guidance.

Detection Methods for CVE-2026-46807

Indicators of Compromise

Unexpected inbound connections to WebLogic T3 (7001/tcp) or IIOP listener ports from untrusted networks or non-administrative hosts.
New or modified administrative accounts, role assignments, or policy changes in Oracle Identity Manager outside of approved change windows.
Anomalous provisioning events or password resets originating from OIM workflows without a corresponding ticket or operator session.
WebLogic server logs showing unauthenticated method invocations against OIM Legacy UI classes.

Detection Strategies

Inspect WebLogic access.log and AdminServer.log for T3/IIOP requests that do not correlate with known integrations or administrators.
Enable and review OIM audit logs for privileged operations executed without an associated authenticated session identifier.
Deploy network monitoring rules to flag T3/IIOP traffic crossing trust boundaries, since these protocols should rarely traverse perimeter or segmentation controls.

Monitoring Recommendations

Forward WebLogic, OIM, and host telemetry to a centralized SIEM and correlate authentication events with identity changes downstream.
Baseline expected T3/IIOP client IPs and alert on deviations, including new source ASNs or geographies.
Monitor for weblogic.iiop and weblogic.rjvm exceptions or stack traces that may indicate exploitation attempts.

How to Mitigate CVE-2026-46807

Immediate Actions Required

Apply the Oracle June 2026 Critical Patch Update to Identity Manager 12.2.1.4.0 and 14.1.2.1.0 deployments without delay.
Restrict network access to the WebLogic T3 and IIOP listeners using firewall rules, allowing only known management hosts.
Audit Identity Manager administrative accounts, recent role changes, and provisioning activity for signs of unauthorized modification.
Rotate credentials and API keys for connected systems if compromise cannot be ruled out.

Patch Information

Oracle released fixes for CVE-2026-46807 as part of the June 2026 Critical Patch Update. Administrators should consult the Oracle Critical Patch Update Advisory - June 2026 for the specific patch identifiers applicable to Identity Manager 12.2.1.4.0 and 14.1.2.1.0, including any prerequisite Fusion Middleware bundle patches.

Workarounds

Use the WebLogic connection filter (weblogic.security.net.ConnectionFilterImpl) to deny T3 and IIOP traffic from untrusted source networks until patching is complete.
Disable IIOP on the WebLogic managed servers hosting OIM if it is not required by integrations.
Place Identity Manager behind a reverse proxy or jump host so that T3/IIOP endpoints are not exposed to general enterprise network segments.

bash

# Example WebLogic connection filter rules (configure in Admin Console > Security)
# Allow only the administrative subnet to reach T3 and IIOP, deny all others.
10.10.20.0/24 * * allow t3 t3s iiop iiops
0.0.0.0/0    * * deny  t3 t3s iiop iiops