A critical vulnerability in Oracle Identity Manager allows authenticated attackers with low privileges to take over the application, potentially impacting the broader Fusion Middleware environment.

This is an easily exploitable flaw in the OIM Legacy UI component that permits a low privileged, authenticated attacker with network access to execute unauthorized actions via Remote Method Invocation (RMI). Due to a change in security scope, successful exploitation can lead to a complete takeover of the Identity Manager and potentially affect integrated products.

The vulnerability carries a CVSS score of 9.9, reflecting its extreme severity. Successful exploitation allows for a full system takeover, which could result in the compromise of sensitive identity data, unauthorized administrative access, and potential lateral movement into other connected systems within the enterprise environment.

Immediate Action: Apply the security updates provided by Oracle in the August 2026 Critical Patch Update (CPU) to remediate the vulnerable OIM Legacy UI component.

Proactive Monitoring: Monitor RMI traffic for anomalous patterns and review application access logs for unexpected administrative actions performed by low privileged accounts.

Compensating Controls: Restrict network access to the RMI interface to only known, trusted management segments and employ network segmentation to limit the potential blast radius of a compromised identity server.

Public Exploit Available: No

Given the critical CVSS score of 9.9 and the potential for full system takeover, this vulnerability poses an immediate and severe risk. IT administrators must prioritize the application of the August 2026 Oracle CPU to ensure that Identity Manager is protected against potential exploitation.