CVE-2026-73942 Oracle CVE debrief

Who should care

Identity Manager administrators, security teams, and IT professionals responsible for Oracle Identity Manager deployments should assess exposure and take necessary actions to protect against this vulnerability.

Why it matters

This vulnerability in Oracle Identity Manager's OIM Legacy UI component poses a significant risk to organizations using affected versions. Low-privileged attackers with network access via HTTP can compromise the product, leading to potential takeover and data breaches. Immediate attention is required from Identity Manager administrators and security teams to assess exposure, apply patches, and implement compensating controls if necessary.

• Potential takeover of Oracle Identity Manager instances by low-privileged attackers
• Compromise of confidentiality, integrity, and availability of Oracle Identity Manager systems and data
• Need for immediate patching or compensating controls to prevent exploitation
• Potential lateral movement and further exploitation within the network

Technical summary

The vulnerability is in the OIM Legacy UI component of Oracle Identity Manager, affecting versions 12.2.1.4.0 and 14.1.2.1.0. It allows low-privileged attackers with network access via HTTP to compromise the product, potentially leading to a takeover of Oracle Identity Manager. The vulnerability has a CVSS score of 8.8, indicating high severity. The CVE record and NVD entry provide details on the vulnerability, affected versions, and CVSS score. Defenders should assess exposure, apply patches or updates provided by Oracle, and implement compensating controls if necessary.

Defensive priority

High priority for Identity Manager administrators and security teams to assess exposure and apply patches

Recommended defensive actions

• Assess exposure of Oracle Identity Manager instances, particularly versions 12.2.1.4.0 and 14.1.2.1.0
• Apply patches or updates provided by Oracle
• Monitor for suspicious activity and implement compensating controls if patches cannot be applied immediately
• Verify the integrity of Oracle Identity Manager systems and data
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and CVSS score. The vulnerability is in the OIM Legacy UI component of Oracle Identity Manager, affecting versions 12.2.1.4.0 and 14.1.2.1.0. The CVSS score of 8.8 indicates high severity. Defenders should verify the integrity of Oracle Identity Manager systems and data, and review compensating controls for exposed systems while remediation is scheduled and verified.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.