CVE-2026-83422: Oracle Identity Manager Auth Bypass Flaw

CVE-2026-83422 Overview

CVE-2026-83422 is a vulnerability in the Oracle Identity Manager (OIM) product of Oracle Fusion Middleware, specifically in the OIM Legacy UI component. The flaw affects supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via HTTP can exploit this issue, though successful attacks require human interaction from a person other than the attacker. Exploitation can result in unauthorized creation, deletion, or modification of critical data, as well as unauthorized read access to all data accessible through Oracle Identity Manager.

Critical Impact
An unauthenticated remote attacker who convinces a legitimate user to interact with a crafted request can compromise the confidentiality and integrity of all data managed by Oracle Identity Manager.

Affected Products

Oracle Identity Manager 12.2.1.4.0
Oracle Identity Manager 14.1.2.1.0
Oracle Fusion Middleware — OIM Legacy UI component

Discovery Timeline

2026-09-15 - CVE-2026-83422 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-83422

Vulnerability Analysis

The vulnerability resides in the OIM Legacy UI component of Oracle Identity Manager, an enterprise identity governance product used to provision, manage, and audit user accounts across integrated systems. The Oracle security advisory classifies the flaw as easily exploitable over the network without authentication. The attack requires user interaction, indicating an exploitation pattern consistent with a client-triggered request against the legacy web interface.

A successful attack yields high impact to confidentiality and integrity, but does not affect availability. Because Oracle Identity Manager brokers privileged accounts and entitlements across an enterprise, unauthorized modification of its data can cascade into downstream provisioning changes on connected systems.

Root Cause

Oracle has not publicly released the specific root cause or Common Weakness Enumeration (CWE) identifier for this issue. Based on the CVSS metrics — network vector, no privileges required, and required user interaction — the flaw is consistent with a client-side triggered issue in the Legacy UI, such as improper request validation or an unsafe handling of user-supplied input rendered by a privileged browser session.

Attack Vector

The attacker delivers a crafted HTTP request or link targeting the OIM Legacy UI. When a legitimate user interacts with the attacker-controlled content, the request executes in the context of that user's session against Oracle Identity Manager. The result is unauthorized read access to identity data and the ability to create, delete, or modify records the victim's session can reach.

No verified public proof-of-concept is available. Refer to the Oracle Security Alert Advisory for vendor-published technical detail.

Detection Methods for CVE-2026-83422

Indicators of Compromise

Unexpected account creation, deletion, or role assignment events originating from the OIM Legacy UI.
HTTP requests to Legacy UI endpoints containing anomalous parameters or referrers from external domains.
Session activity from privileged OIM users immediately following external link clicks or email interactions.

Detection Strategies

Correlate OIM administrative audit logs with web access logs to identify actions initiated via cross-origin requests.
Alert on identity provisioning changes that occur outside approved change windows or ticketed workflows.
Baseline normal Legacy UI request patterns and flag deviations, particularly requests carrying state-changing operations without prior navigation context.

Monitoring Recommendations

Forward Oracle Identity Manager audit and access logs to a centralized SIEM for correlation with endpoint and email telemetry.
Monitor for phishing campaigns targeting OIM administrators and identity governance operators.
Track downstream provisioning systems for unexpected account or entitlement changes sourced from OIM.

How to Mitigate CVE-2026-83422

Immediate Actions Required

Apply the Oracle Critical Patch Update referenced in the Oracle Security Alert Advisory to all affected Oracle Identity Manager deployments.
Inventory environments running Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 and prioritize patching internet-exposed or partner-accessible instances.
Restrict network access to the OIM Legacy UI to trusted administrative networks pending remediation.

Patch Information

Oracle has addressed CVE-2026-83422 in the Critical Patch Update published in the Oracle Security Alert Advisory. Apply the vendor-supplied patch for Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 according to Oracle's deployment guidance.

Workarounds

Disable or restrict access to the OIM Legacy UI component where operationally feasible and use the modern UI instead.
Enforce strict browser isolation or dedicated administrative workstations for OIM administrator sessions.
Require re-authentication and step-up authentication for high-impact identity operations to reduce the value of a hijacked session.

bash

# Example: restrict access to the OIM Legacy UI at the reverse proxy layer
# (Adapt to your web tier - Apache, NGINX, or Oracle HTTP Server)
location /oim/faces/legacy/ {
    allow 10.0.0.0/8;      # trusted admin subnet
    deny  all;
    proxy_pass https://oim-backend.internal;
}