CVE-2026-73942: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-73942 Overview

CVE-2026-73942 is an improper access control vulnerability [CWE-284] in the Oracle Identity Manager (OIM) product of Oracle Fusion Middleware. The flaw resides in the OIM Legacy UI component and affects supported versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with network access over HTTP can exploit the weakness to compromise Oracle Identity Manager. Successful exploitation results in full takeover of the affected instance, impacting confidentiality, integrity, and availability. Oracle addressed the issue in its September 2026 Critical Patch Update Security Alert.

Critical Impact
Successful exploitation allows a low-privileged remote attacker to take over Oracle Identity Manager, exposing enterprise identity data and enabling downstream account and privilege abuse.

Affected Products

Oracle Fusion Middleware — Oracle Identity Manager 12.2.1.4.0
Oracle Fusion Middleware — Oracle Identity Manager 14.1.2.1.0
Component: OIM Legacy UI

Discovery Timeline

2026-09-15 - CVE-2026-73942 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-73942

Vulnerability Analysis

The vulnerability sits in the OIM Legacy UI component of Oracle Identity Manager. The component fails to enforce proper access control on HTTP-reachable functionality [CWE-284]. Any authenticated user with low privileges can invoke sensitive operations that should be restricted to administrators. Because Oracle Identity Manager governs provisioning, entitlements, and identity workflows, a takeover extends the blast radius across every downstream application that trusts OIM for identity data.

Root Cause

The underlying defect is improper access control in the OIM Legacy UI. Authorization checks are either missing or insufficient on privileged endpoints exposed through the legacy interface. As a result, the server accepts requests from principals that should be rejected, allowing low-privileged sessions to reach administrative functionality.

Attack Vector

Exploitation is remote and network-based over HTTP. The attacker must hold a valid low-privileged account on the target Oracle Identity Manager instance. No user interaction is required, attack complexity is low, and the scope remains unchanged. Once inside, the attacker can pivot to modify identities, escalate privileges, or exfiltrate sensitive identity records. Oracle has not published proof-of-concept code, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical details are limited to the Oracle Security Alert.

Detection Methods for CVE-2026-73942

Indicators of Compromise

Unexpected administrative actions in OIM audit logs originating from low-privileged accounts.
HTTP requests to OIM Legacy UI endpoints that bypass normal navigation flows.
Newly created or modified administrator roles, entitlements, or provisioning policies without a matching change ticket.

Detection Strategies

Correlate authentication events with subsequent privileged operations in OIM to flag privilege mismatches.
Enable and centrally forward Oracle Identity Manager audit logs and WebLogic access logs to a SIEM for rule-based analysis.
Alert on access to deprecated Legacy UI paths from user accounts that historically use only the modern UI or SOAP/REST APIs.

Monitoring Recommendations

Baseline normal request patterns per OIM role and alert on statistical deviations.
Monitor outbound identity changes propagated to connected downstream systems for anomalous bulk operations.
Track failed authorization events and repeated 4xx responses on Legacy UI endpoints that precede successful privileged calls.

How to Mitigate CVE-2026-73942

Immediate Actions Required

Apply the Oracle Critical Patch Update Security Alert fixes for Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 as published in the September 2026 alert.
Inventory all OIM instances and confirm patch coverage across production, staging, and disaster recovery environments.
Rotate credentials and review recently created accounts, roles, and entitlements for signs of abuse.

Patch Information

Oracle released fixes as part of the September 2026 Critical Patch Update Security Alert. Refer to the Oracle Security Alert for patch identifiers, affected components, and installation guidance for each supported Oracle Identity Manager release.

Workarounds

Restrict network access to the OIM Legacy UI so only trusted administrative networks can reach it, pending patch deployment.
Disable or block the Legacy UI at the reverse proxy or web tier if operational requirements allow.
Enforce least privilege on OIM accounts and remove unused low-privileged accounts that could be used for exploitation.

bash

# Example reverse-proxy restriction for the OIM Legacy UI path
# (Adapt path and allowlist to your environment)
location /identity/faces/ {
    allow 10.10.20.0/24;   # admin jump network
    deny  all;
    proxy_pass http://oim-backend;
}