CVE-2026-70915: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-70915 Overview

CVE-2026-70915 is a network-exploitable vulnerability in the Core component of Oracle Identity Manager, part of Oracle Fusion Middleware. Oracle's advisory identifies supported versions 12.2.1.4.0 and 14.1.2.1.0 as affected. A low-privileged attacker with network access via the T3 or Internet Inter-ORB Protocol (IIOP) protocols can compromise the product. Successful exploitation leads to full takeover of Oracle Identity Manager, impacting confidentiality, integrity, and availability. The weakness maps to Improper Access Control [CWE-284]. Oracle published details in the CSPU Emergency Patch advisory referenced below.

Critical Impact
Successful exploitation results in full takeover of Oracle Identity Manager, the system that governs identity provisioning, entitlements, and privileged access across the enterprise.

Affected Products

Oracle Identity Manager (Oracle Fusion Middleware) version 12.2.1.4.0
Oracle Identity Manager (Oracle Fusion Middleware) version 14.1.2.1.0
Core component (T3 and IIOP remote protocol surfaces)

Discovery Timeline

2026-09-15 - CVE-2026-70915 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-70915

Vulnerability Analysis

The flaw resides in the Core component of Oracle Identity Manager. Oracle classifies exploitation as easily achievable over the network by an attacker with low privileges and no user interaction. The remote protocols involved are Oracle WebLogic's proprietary T3 protocol and IIOP, both of which expose Remote Method Invocation (RMI) endpoints on the managed server. Compromise of Oracle Identity Manager is significant because the product controls user provisioning, role assignment, and password management across downstream applications.

Root Cause

The issue is categorized under [CWE-284] Improper Access Control. Access control on the Core component fails to adequately restrict authenticated actions requested through T3 or IIOP. A user holding only low-privileged credentials can invoke operations that should be reserved for administrators, resulting in unscoped changes to identity state.

Attack Vector

An attacker authenticates to the WebLogic managed server hosting Oracle Identity Manager and issues requests over the T3 or IIOP listener. Because both protocols carry serialized Java objects and RMI invocations, the exposed surface allows the attacker to reach internal Identity Manager services. From there, the improper access control enables the attacker to escalate control of the product itself, achieving takeover of accounts, roles, and workflows managed by the platform.

No verified proof-of-concept code has been published. See the Oracle Security Alert CSPUSEP2026 for technical context and patch details.

Detection Methods for CVE-2026-70915

Indicators of Compromise

Unexpected T3 or IIOP connections to the Oracle Identity Manager managed server from workstations, jump hosts, or subnets that do not normally administer WebLogic.
Creation, modification, or role escalation of Identity Manager accounts outside change windows, especially assignments to administrator or privileged roles.
WebLogic server logs showing RMI invocations to internal Identity Manager services by low-privileged accounts.
New scheduled tasks, event handlers, or adapters in Oracle Identity Manager that were not authorized by change management.

Detection Strategies

Inspect WebLogic access and audit logs for T3 and IIOP calls that reference oim, xelsysadm, or internal oracle.iam.* service classes from unusual principals.
Correlate Identity Manager audit events with source IP and session data to detect privilege changes originating from low-privileged accounts.
Baseline normal administrative traffic to the managed server and alert on deviations in protocol, source, or invoked method.

Monitoring Recommendations

Forward WebLogic server logs, Oracle Identity Manager audit tables, and network flow records to a central analytics platform for continuous correlation.
Alert on any modification to xelsysadm or other Identity Manager system accounts, including password resets and role membership changes.
Monitor egress from the Identity Manager host for connections to systems that receive provisioning events, and flag anomalous downstream account changes.

How to Mitigate CVE-2026-70915

Immediate Actions Required

Apply the Oracle CSPU Emergency Patch for Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 as documented in the vendor advisory.
Restrict T3 and IIOP listener access to trusted management networks using WebLogic connection filters and network segmentation.
Rotate credentials for xelsysadm and any privileged Identity Manager service accounts after patching.
Review recent Identity Manager audit logs for unauthorized role assignments or account creations and roll back changes as needed.

Patch Information

Oracle addressed CVE-2026-70915 in the CSPU Emergency Patch cycle. Refer to the Oracle Security Alert CSPUSEP2026 for patch identifiers, download locations, and version-specific installation guidance. Apply the patch to both 12.2.1.4.0 and 14.1.2.1.0 deployments.

Workarounds

Use WebLogic connection filters such as weblogic.security.net.ConnectionFilterImpl to deny T3 and IIOP traffic from untrusted sources when patching is delayed.
Disable the IIOP listener on the managed server if no application component requires it.
Place the Oracle Identity Manager managed server behind a management VLAN or bastion so that only administrator workstations can reach the T3 and IIOP ports.

bash

# Example WebLogic connection filter rules to restrict T3 and IIOP
# Configure under: Domain > Security > Filter > Connection Filter Rules
10.10.20.0/24 * * allow t3 t3s iiop iiops
0.0.0.0/0    * * deny  t3 t3s iiop iiops