CVE-2026-73943: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-73943 Overview

CVE-2026-73943 is an access control weakness [CWE-284] in the Oracle Identity Manager (OIM) Legacy UI component of Oracle Fusion Middleware. Affected supported versions are 12.2.1.4.0 and 14.1.2.1.0. An authenticated attacker with high privileges and network access over HTTP can compromise Oracle Identity Manager. Successful exploitation results in unauthorized read access to all OIM-accessible data and partial unauthorized update, insert, or delete access. The vulnerability carries a scope change, meaning exploitation can impact resources beyond OIM itself.

Critical Impact
An authenticated high-privileged attacker can gain complete read access to Oracle Identity Manager data and modify a subset of that data, with cascading impact to additional Fusion Middleware components.

Affected Products

Oracle Fusion Middleware — Oracle Identity Manager 12.2.1.4.0
Oracle Fusion Middleware — Oracle Identity Manager 14.1.2.1.0
Component: OIM Legacy UI

Discovery Timeline

2026-09-15 - CVE-2026-73943 published to the National Vulnerability Database
2026-09-15 - Oracle publishes Security Alert CSPUSEP2026 referencing the issue
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-73943

Vulnerability Analysis

The flaw resides in the OIM Legacy UI, a browser-facing administrative interface within Oracle Identity Manager. The weakness maps to CWE-284: Improper Access Control, indicating the component fails to correctly enforce authorization boundaries on protected operations.

An attacker who already holds a high-privileged OIM account can invoke functionality that exposes or manipulates data the account should not reach. Because Oracle Identity Manager brokers accounts, entitlements, and provisioning across enterprise systems, unauthorized access to its data can cascade into downstream directories and applications. The scope change reflected in the CVSS vector confirms this cross-component blast radius.

Exploitation impacts confidentiality fully and integrity partially. Availability is not affected. There is no user interaction requirement, which allows automated abuse once valid credentials are held.

Root Cause

The root cause is improper access control within the OIM Legacy UI request handling path. Authorization checks do not adequately restrict privileged operations to the intended set of actors or objects, permitting a privileged user to bypass intended data boundaries.

Attack Vector

Exploitation occurs over HTTP against the OIM Legacy UI. The attacker must first authenticate with high privileges — a compromised administrator, delegated administrator, or a privileged service account is sufficient. No user interaction or social engineering is required. See the Oracle Security Alert CSPUSEP2026 for the vendor's guidance.

Oracle has not published exploit details. No public proof-of-concept is available at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability at publication is 0.258%.

Detection Methods for CVE-2026-73943

Indicators of Compromise

Unexpected HTTP requests to OIM Legacy UI endpoints originating from privileged accounts outside normal administrative windows.
Anomalous read or export operations against OIM user, role, or entitlement objects.
Unauthorized modifications to identity records, provisioning tasks, or approval workflows performed by admin accounts.
Session activity from privileged OIM accounts sourced from unusual IP ranges or geographies.

Detection Strategies

Enable OIM audit logging and forward events to a central SIEM for correlation against baseline administrator behavior.
Alert on high-volume queries against USR, ROLE, and provisioning tables by interactive OIM sessions.
Correlate OIM Legacy UI access with Fusion Middleware access logs to spot scope-changing operations that touch adjacent components.

Monitoring Recommendations

Monitor Oracle HTTP Server or WebLogic access logs for /oim/faces/ and legacy console URIs invoked by non-standard user agents.
Track privileged OIM account authentications and flag concurrent sessions or off-hours logins.
Baseline provisioning job creation, entitlement grants, and role assignments to surface unauthorized changes.

How to Mitigate CVE-2026-73943

Immediate Actions Required

Apply the patches referenced in Oracle Security Alert CSPUSEP2026 to OIM 12.2.1.4.0 and 14.1.2.1.0 deployments.
Rotate credentials for all OIM administrators and privileged service accounts following patching.
Review recent audit logs for suspicious activity by privileged accounts on the OIM Legacy UI.
Restrict network reachability of the OIM Legacy UI to trusted administrative networks only.

Patch Information

Oracle addressed CVE-2026-73943 in the security fixes shipped with Oracle Security Alert CSPUSEP2026. Administrators should consult the alert for the exact patch bundle identifiers applicable to Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0, then apply them following Oracle's Fusion Middleware patch procedure.

Workarounds

Disable or restrict access to the OIM Legacy UI if it is not required for daily operations.
Enforce multi-factor authentication for all OIM administrator accounts to raise the bar for credential compromise.
Apply strict network ACLs or reverse-proxy allowlists in front of the OIM administrative endpoints.
Reduce the number of accounts holding high OIM privileges and review delegated administration assignments.

bash

# Example: restrict OIM Legacy UI access at the reverse proxy (Oracle HTTP Server)
<Location /oim/faces/>
    Require ip 10.0.0.0/8
    Require ip 192.168.10.0/24
</Location>