CVE-2026-71047: Oracle Identity Manager Auth Bypass

CVE-2026-71047 Overview

CVE-2026-71047 is an access control vulnerability [CWE-284] in the Core component of Oracle Identity Manager, part of Oracle Fusion Middleware. Affected versions include 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with network access via HTTP can exploit the flaw without user interaction. Successful exploitation results in full takeover of the Oracle Identity Manager instance, with impact to confidentiality, integrity, and availability. Oracle addressed the issue in its September 2026 Critical Patch Update Special.

Critical Impact
Authenticated attackers holding minimal privileges can compromise Oracle Identity Manager over the network and gain complete control of the identity governance platform.

Affected Products

Oracle Identity Manager 12.2.1.4.0
Oracle Identity Manager 14.1.2.1.0
Oracle Fusion Middleware (Identity Manager Core component)

Discovery Timeline

2026-09-15 - CVE-2026-71047 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-71047

Vulnerability Analysis

CVE-2026-71047 resides in the Core component of Oracle Identity Manager, the identity governance and administration product within Oracle Fusion Middleware. The weakness is classified under [CWE-284] (Improper Access Control), indicating that the product fails to correctly restrict operations to authorized users.

An attacker who already holds a low-privileged account can send crafted HTTP requests to the application to bypass access controls in the Core component. Because Oracle Identity Manager centrally manages identities, entitlements, and provisioning across downstream enterprise systems, a takeover extends the blast radius well beyond the product itself. A compromised Identity Manager can be used to create rogue accounts, alter group memberships, and grant privileged entitlements across integrated systems.

Root Cause

The root cause is improper access control within the Oracle Identity Manager Core component. The application does not adequately validate that the authenticated principal is authorized to perform requested actions. Oracle's advisory does not disclose the specific handler or API endpoint at fault. Refer to the Oracle Security Alert CSPUSep2026 for vendor-supplied technical details.

Attack Vector

The vulnerability is exploitable remotely over HTTP with low attack complexity. The attacker requires authenticated access with low privileges but does not need user interaction. The scope remains unchanged, but confidentiality, integrity, and availability are all rated as high impact. Any user account that can authenticate to the Identity Manager web tier, including self-service users, represents a viable starting point for exploitation.

No verified proof-of-concept code is publicly available.
See the Oracle Security Alert CSPUSep2026 for vendor guidance:
https://www.oracle.com/security-alerts/cspusep2026.html

Detection Methods for CVE-2026-71047

Indicators of Compromise

Unexpected creation, modification, or deletion of user accounts, roles, or entitlements within Oracle Identity Manager audit logs.
HTTP requests from low-privileged accounts targeting administrative or privileged endpoints in the Identity Manager Core component.
Sudden changes to provisioning policies, reconciliation rules, or approval workflows without a corresponding change ticket.
Anomalous session activity, such as privilege elevation events, tied to accounts that historically only performed self-service actions.

Detection Strategies

Enable and forward Oracle Identity Manager audit and application server logs to a centralized analytics platform for behavioral correlation.
Baseline normal administrative activity per account and alert on deviations, particularly privilege changes initiated by non-administrator identities.
Alert on repeated HTTP 4xx or 5xx responses on Identity Manager administrative endpoints originating from a single authenticated session, which may indicate exploitation probing.
Correlate downstream identity provider changes (Active Directory, Entra ID, target systems) with Identity Manager provisioning events to detect out-of-band modifications.

Monitoring Recommendations

Monitor privileged group memberships and Identity Manager administrator role assignments for unauthorized additions.
Track authentication patterns for service accounts and low-privileged users that access the Identity Manager web tier.
Review WebLogic access logs for unusual URI patterns targeting /identity/ or /iam/ paths from unexpected source addresses.

How to Mitigate CVE-2026-71047

Immediate Actions Required

Apply the Oracle September 2026 Critical Patch Update Special (CSPUSep2026) to Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 without delay.
Inventory all Oracle Identity Manager deployments and confirm patch status against the vendor advisory.
Rotate credentials and review privileged role assignments in Identity Manager and integrated target systems after patching.
Restrict network exposure of the Identity Manager web tier to trusted management networks where feasible.

Patch Information

Oracle addressed CVE-2026-71047 in the September 2026 Critical Patch Update Special. Administrators should download and apply the update as documented in the Oracle Security Alert CSPUSep2026. Oracle recommends applying Critical Patch Update fixes as soon as possible.

Workarounds

No official vendor workaround is published; patching is the required remediation.
Reduce exposure by placing Identity Manager behind a reverse proxy or WAF that restricts access to authenticated administrative paths.
Enforce strong authentication (multi-factor) for all Identity Manager users to raise the cost of acquiring the low-privileged foothold required for exploitation.
Temporarily suspend or restrict low-privileged self-service accounts that do not require active access until patching is complete.

bash

# Verify Oracle Identity Manager patch inventory (WebLogic OPatch example)
cd $ORACLE_HOME/OPatch
./opatch lsinventory | grep -i "Identity Manager"

# Restrict administrative endpoints at the reverse proxy (nginx example)
# location /identity/admin/ {
#     allow 10.10.20.0/24;   # trusted admin subnet
#     deny  all;
#     proxy_pass http://oim_backend;
# }