CVE-2026-70913: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-70913 Overview

CVE-2026-70913 is an authentication weakness [CWE-287] in the Core component of Oracle Identity Manager, part of Oracle Fusion Middleware. An unauthenticated attacker with network access over HTTP can compromise the product without user interaction. Successful exploitation results in full takeover of Oracle Identity Manager, affecting confidentiality, integrity, and availability.

Oracle Identity Manager governs user provisioning, access certification, and identity lifecycle across enterprise environments. A takeover of this component gives attackers control over downstream identity workflows and connected target systems.

Critical Impact
Unauthenticated remote attackers can take over Oracle Identity Manager over HTTP, gaining control of enterprise identity governance and provisioning workflows.

Affected Products

Oracle Fusion Middleware — Oracle Identity Manager
Oracle Identity Manager version 12.2.1.4.0
Oracle Identity Manager version 14.1.2.1.0

Discovery Timeline

2026-09-15 - CVE-2026-70913 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-70913

Vulnerability Analysis

The flaw resides in the Core component of Oracle Identity Manager. Oracle classifies it as easily exploitable with no authentication and no user interaction required. An attacker only needs network reachability to the HTTP interface of the affected server.

Because the weakness maps to [CWE-287] Improper Authentication, an unauthenticated request can reach functionality that should be restricted to trusted principals. The result is full compromise of the Identity Manager application, including administrative capabilities that govern user accounts and entitlements across integrated systems.

Oracle has not published exploit code, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog at time of writing. The EPSS probability is 0.331%, reflecting a low modeled likelihood of near-term exploitation despite the severe impact profile.

Root Cause

The root cause is improper authentication in the Core component. Access controls fail to validate the identity of the caller before executing privileged operations. Because Oracle has not disclosed the specific code path, defenders should treat any exposed HTTP endpoint of Oracle Identity Manager as reachable by an attacker.

Attack Vector

Exploitation occurs over the network using HTTP against the Oracle Identity Manager web tier. The attacker does not need prior credentials or a foothold in the environment. Any Identity Manager instance reachable from an untrusted network, including through a proxy or load balancer, is exposed.

Oracle has not released proof-of-concept code. Refer to the Oracle Security Alert for the vendor-authoritative technical description.

Detection Methods for CVE-2026-70913

Indicators of Compromise

Unauthenticated HTTP requests to Oracle Identity Manager administrative endpoints returning 200 OK without a valid session cookie or bearer token.
Creation of new Identity Manager administrator accounts, roles, or entitlements outside of change-approved windows.
Unexpected connector runs, provisioning tasks, or password resets originating from the Identity Manager service account.
Outbound connections from Identity Manager hosts to unknown external IP addresses following inbound HTTP traffic bursts.

Detection Strategies

Correlate web-tier access logs with Identity Manager audit events to flag privileged actions that have no preceding authenticated session.
Baseline normal request patterns to Identity Manager URIs and alert on anomalous verb, path, or parameter combinations.
Monitor Identity Manager operational tables and event handlers for unauthorized modifications to workflow definitions and adapters.

Monitoring Recommendations

Forward Oracle Identity Manager access logs, audit logs, and WebLogic server logs to a centralized analytics platform for correlation.
Alert on downstream target-system changes that lack a matching approved Identity Manager request record.
Track authentication failures followed by successful privileged operations from the same source IP or user-agent.

How to Mitigate CVE-2026-70913

Immediate Actions Required

Apply the Oracle Critical Patch Update or Security Alert fix referenced in the Oracle Security Alert to Identity Manager 12.2.1.4.0 and 14.1.2.1.0.
Restrict network access to Identity Manager HTTP interfaces to trusted administrative networks and identity-integration systems only.
Audit Identity Manager administrators, roles, and recently created accounts for unauthorized changes.
Rotate credentials, API keys, and connector secrets stored within Identity Manager if compromise cannot be ruled out.

Patch Information

Oracle has released fixes as part of its Security Alert program. Consult the Oracle Security Alert for the exact patch bundle, prerequisites, and post-installation validation steps applicable to 12.2.1.4.0 and 14.1.2.1.0.

Workarounds

Place Identity Manager behind a reverse proxy or web application firewall that enforces authentication before requests reach the application tier.
Disable or block external access to non-essential Identity Manager endpoints until patches are validated in production.
Enforce network segmentation so Identity Manager is unreachable from user workstation subnets and internet-facing DMZs.

bash

# Example: restrict Oracle Identity Manager HTTP access at the host firewall
# Replace <admin_subnet> with the approved management CIDR
iptables -A INPUT -p tcp --dport 14000 -s <admin_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport 14000 -j DROP