CVE-2026-83402 Oracle Corporation CVE debrief

Who should care

Identity management teams, security teams, and administrators of Oracle Identity Manager should be aware of this vulnerability due to its high CVSS score and potential for significant compromise. These teams are responsible for ensuring the security and integrity of identity management systems and should take immediate action to review and apply Oracle's security patches, restrict access to the OIM Legacy UI, and monitor for suspicious activity.

Why it matters

This vulnerability requires immediate attention from identity management teams and security administrators due to its high CVSS score and potential for compromise.

• Potential takeover of Oracle Identity Manager
• Compromise of confidentiality, integrity, and availability

Technical summary

The vulnerability in Oracle Identity Manager's OIM Legacy UI component allows low-privileged attackers with network access via HTTPS to compromise the product, potentially leading to a takeover. The vulnerability has a CVSS score of 8.8, indicating high severity, and affects versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Identity Manager. The vulnerability is exploitable due to inadequate security controls in the OIM Legacy UI, allowing attackers to gain unauthorized access and potentially compromise the confidentiality, integrity, and availability of the system.

Defensive priority

High priority for identity management systems, especially those with exposed legacy UIs.

Recommended defensive actions

• Review and apply Oracle's security patches for affected versions of Oracle Identity Manager.
• Restrict access to the OIM Legacy UI to minimize exposure.
• Monitor for suspicious activity on identity management systems, especially those with exposed legacy UIs.
• Conduct a thorough review of the current security posture of Oracle Identity Manager deployments.
• Verify that compensating controls are in place for exposed systems while remediation is scheduled and verified.
• Track exceptions and retest remediated assets to ensure the vulnerability is properly addressed.
• Perform a detailed asset inventory to identify all affected systems and prioritize remediation efforts.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impacts, and affected versions. The vulnerability is identified as CVE-2026-83402, with a CVSS score of 8.8, indicating high severity. The affected versions of Oracle Identity Manager are 12.2.1.4.0 and 14.1.2.1.0. The vulnerability allows low-privileged attackers with network access via HTTPS to compromise the product, potentially leading to a takeover. The evidence from the CVE record and NVD entry suggests that this vulnerability has not been modified since its

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.