CVE-2026-46807

Critical · CVSS 9.8

Oracle Identity Manager (OIM) — Missing Authentication for Critical Function (CWE-306) leading to unauthenticated RCE / full system takeover via T3/IIOP

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: other; CWE-306

Description

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Search profile — drives PoC discovery

Symbols OIM Legacy UIT3IIOPIdentity Manageroracle.iamOIMClientt3://iiop://weblogic.securityOracleIAM

Keywords CVE-2026-46807Oracle Identity ManagerOIM Legacy UIT3 IIOP unauthenticatedOracle Fusion Middleware OIM exploitOIM 12.2.1.4.0 vulnerabilityOIM 14.1.2.1.0 vulnerabilityOracle IAM missing authenticationOIM takeover PoCCWE-306 Oracle OIM

Versions: 12.2.1.4.0, 14.1.2.1.0

References

https://www.oracle.com/security-alerts/cspujun2026.html

Status: enriched · ingested 2026-06-19T12:00:04.000Z · profiled 2026-06-19T12:30:04.000Z