Critical severity · published Jun 16, 2026
CVE-2026-46807
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI)
9.8
CVSS
0.5%
EPSS
No
On KEV
Description
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Identity Manager. Successful attacks of this vulnerability can result in takeover of Identity Manager. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
Identity Manager · Oracle Corporation
12.2.1.4.0; 14.1.2.1.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-46807
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-46807
Vendor Advisory
https://www.oracle.com/security-alerts/cspujun2026.html
More from Identity Manager
9.8
CVE-2025-61757
Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability
9.9
CVE-2026-35268
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Core)
8.8
CVE-2026-35267
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices)
8.8
CVE-2026-35265
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Security)
7.5
CVE-2026-35269
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices)