CVE-2026-46810: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-46810 Overview

CVE-2026-46810 is an access control vulnerability [CWE-284] in the Oracle Identity Manager component of Oracle Fusion Middleware. The flaw resides in the End User Self Service component and affects supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via the Internet Inter-ORB Protocol (IIOP) can exploit this issue to compromise Oracle Identity Manager. Successful exploitation results in unauthorized update, insert, or delete operations on a subset of accessible data, along with unauthorized read access to a portion of Identity Manager data.

Critical Impact
Unauthenticated network attackers can modify and read identity data managed by Oracle Identity Manager, undermining identity governance integrity.

Affected Products

Oracle Identity Manager 12.2.1.4.0
Oracle Identity Manager 14.1.2.1.0
Oracle Fusion Middleware (End User Self Service component)

Discovery Timeline

2026-06-17 - CVE-2026-46810 published to NVD
2026-06-17 - Last updated in NVD database
2026-06-17 - Oracle Critical Security Patch Update published (Oracle Security Alert)

Technical Details for CVE-2026-46810

Vulnerability Analysis

The vulnerability is classified as Improper Access Control [CWE-284] within the End User Self Service component of Oracle Identity Manager. Oracle Identity Manager is the identity governance platform that provisions, manages, and audits user accounts across enterprise systems. A weakness in access enforcement on the IIOP listener allows requests to reach protected operations without prior authentication.

Because IIOP is exposed over the network and the attack requires no credentials and no user interaction, exploitation is straightforward for an attacker with reachability to the service. The impact is limited to a subset of accessible data, which constrains confidentiality and integrity exposure but does not affect availability.

Identity Manager stores sensitive identity attributes, role assignments, and self-service workflow state. Tampering with this data can weaken downstream authorization decisions across integrated applications.

Root Cause

The root cause is improper enforcement of access control on operations reachable through the IIOP protocol surface of the End User Self Service component. Operations that should be gated behind authenticated, authorized sessions are reachable by anonymous callers over the network.

Attack Vector

The attack vector is network-based via IIOP, the CORBA protocol used by Oracle WebLogic and Fusion Middleware components for remote method invocation. An attacker who can reach the IIOP listener crafts requests that target End User Self Service operations and reads or modifies a subset of Identity Manager data without credentials.

No public proof-of-concept is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Oracle Security Alert for vendor-supplied technical details.

Detection Methods for CVE-2026-46810

Indicators of Compromise

Unexpected IIOP connections to Oracle Identity Manager hosts from untrusted networks or external sources.
Unauthenticated or anonymous invocations recorded in WebLogic and Identity Manager audit logs targeting End User Self Service operations.
Unexplained modifications to user attributes, role memberships, or self-service request records that lack corresponding administrator or end-user session context.

Detection Strategies

Monitor WebLogic access and audit logs for IIOP traffic that lacks an associated authenticated subject before reaching Identity Manager APIs.
Correlate Identity Manager database write events against application-tier session identifiers to surface orphaned changes.
Inspect network flow records for inbound traffic to the IIOP port from sources outside the expected administrative subnets.

Monitoring Recommendations

Forward Oracle Identity Manager and WebLogic audit logs to a centralized SIEM and alert on anomalous IIOP request rates.
Track changes to high-value identity objects such as privileged roles, administrative accounts, and self-service workflow approvals.
Baseline normal IIOP client populations and alert on first-seen source IPs invoking Identity Manager endpoints.

How to Mitigate CVE-2026-46810

Immediate Actions Required

Apply the fixes published in the Oracle Critical Patch Update referenced in the Oracle Security Alert to Identity Manager 12.2.1.4.0 and 14.1.2.1.0.
Restrict network reachability of the IIOP listener to trusted management networks using firewall rules or network segmentation.
Audit recent Identity Manager data for unauthorized changes to user accounts, roles, and self-service requests.

Patch Information

Oracle addressed CVE-2026-46810 in the June 2026 Critical Patch Update. Administrators must download and apply the Identity Manager patches for the affected versions from My Oracle Support and follow the post-install steps documented in the Oracle Security Alert.

Workarounds

Disable the IIOP protocol on WebLogic managed servers hosting Identity Manager where IIOP is not required by integrated applications.
Place Identity Manager behind a reverse proxy or jump host and block direct external access to IIOP and administrative ports.
Enforce strict allow-lists on the network paths permitted to reach Identity Manager listeners until patches are applied.

bash

# Example: restrict IIOP access at the host firewall (Linux iptables)
# Replace 10.0.0.0/24 with your trusted management subnet and 5556 with your IIOP port
iptables -A INPUT -p tcp --dport 5556 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 5556 -j DROP