Oracle Identity Manager is susceptible to a critical remote compromise, potentially leading to unauthorized access and full system takeover.

This vulnerability resides in the OIM Legacy UI component and is exploitable via HTTP. It requires the attacker to have low-level privileges within the system to execute the attack, which subsequently results in a complete compromise of the Identity Manager instance.

With a CVSS score of 9.9, this vulnerability represents a critical threat to identity management infrastructure. A compromise of this product likely grants attackers the ability to manipulate user credentials and access rights, leading to cascading security failures across the entire enterprise environment.

Immediate Action: Update Oracle Identity Manager to the latest version as directed by the August 2026 Oracle security alert to eliminate the vulnerable Legacy UI code path.

Proactive Monitoring: Monitor HTTP access logs for suspicious requests directed at the Legacy UI components and watch for anomalous administrative actions occurring within the identity platform.

Compensating Controls: Disable the Legacy UI if it is not business-critical or enforce strict IP-based access controls to limit interaction with the affected interface to authorized administrative workstations only.

Public Exploit Available: No

Identity management systems are high-value targets for attackers. Organizations must apply the vendor patches without delay to prevent the exploitation of this critical flaw and ensure the continued integrity of user access controls.