Brief Summary: Oracle Identity Manager CVE-2026-35265, a Missing Authentication Flaw Enabling Product Takeover

Introduction

According to Oracle's June 2026 Critical Security Patch Update, a missing authentication check in the Security component of Oracle Identity Manager allows a user with only a low-privileged account and HTTP access to take over the product. Identity Manager is the system that creates accounts, provisions passwords and grants entitlements across connected enterprise applications, so whoever controls it controls a central point of access administration.

Oracle Identity Manager (which Oracle's own documentation treats as the same product as Oracle Identity Governance) is the identity governance and administration platform within Oracle Fusion Middleware. It automates account lifecycle, password provisioning, entitlement grants and access certification through connectors to target applications. Oracle cites analyst recognition for the product line, including a Leader position in the Omdia Identity Governance and Administration 2022 report and Overall, Product and Innovation Leader recognition from KuppingerCole, although no verified market share or installed base figures for the affected versions are public. Its relevance to the wider ecosystem comes from its position upstream of hiring, transfer and separation workflows, from which it pushes access decisions out to every connected system.

Technical Information

Root cause

CISA ADP and NVD classify CVE-2026-35265 as CWE 306, Missing Authentication for Critical Function. MITRE defines this weakness as failing to authenticate functionality that requires a provable user identity or consumes significant resources. In this case, a sensitive function in the Identity Manager Security component could be reached without the authentication and authorization checks it should require. The fix puts those checks back in front of that function, so an ordinary low-privileged session can no longer perform administrator-level actions.

Third-party databases frame the same issue slightly differently: VulDB labels it a privilege escalation, and SentinelOne labels it an authentication bypass. Both framings are consistent with Oracle's description of a low-privileged user reaching takeover.

Identity Manager is closed source, and Oracle does not publish diffs, commit messages or technical write-ups for CPU or CSPU fixes. No source-level patch or code snippet is publicly available, so neither the specific endpoint nor the exact code change can be verified against public sources.

Exploitation prerequisites

Oracle, acting as the CNA, publishes the following vector in its text-form risk matrix:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack Vector: Network. Network access is sufficient. Per the FIRST specification, network scoring also covers attackers inside an intranet.
• Attack Complexity: Low. No specialized access conditions or extenuating circumstances are required.
• Privileges Required: Low. The attacker needs basic user capabilities. Despite the CWE 306 label, Oracle's published scenario is not fully unauthenticated.
• User Interaction: None. No other user has to do anything.
• Scope: Unchanged. The score does not designate impact beyond the vulnerable component's security scope.
• Confidentiality, Integrity, Availability: High. Oracle rates all three impacts as high, summarized as takeover of Identity Manager.

CVSS expresses technical severity. It is not evidence that an attack has occurred, and FIRST explicitly separates it from the additional factors used in organizational risk decisions.

Attack flow

Based on Oracle's description and the CWE classification, the published scenario looks like this:

1. The attacker holds, or obtains, a low-privileged account on an Identity Manager 12.2.1.4.0 or 14.1.2.1.0 deployment.
2. The attacker reaches Identity Manager over HTTP from any network position that can talk to the application.
3. Using that low-privileged session, the attacker sends requests to a sensitive function in the Security component that does not enforce the authentication and authorization it should.
4. The function executes with administrator-level effect, resulting in takeover of Identity Manager.
5. Because Identity Manager provisions and deprovisions access through connectors, a compromised instance is in a position to push access out to connected target systems. No such downstream compromise via this CVE has been reported.

There is no public proof of concept, so the specific URI, request parameters and request sequence are unknown. These requests would look like normal application traffic, which shapes the detection guidance below.

Patch Information

Where the fix lives. Oracle fixed CVE-2026-35265 in its Critical Security Patch Update (CSPU) for June 2026, first released on 16 June 2026. That advisory is the only vendor reference NVD links for this CVE, tagged as a Vendor Advisory. The fixed product is Oracle Identity Manager, Security component, and the CSPU lists the two supported affected releases as 12.2.1.4.0 and 14.1.2.1.0. Each release line needs its own patch.

What a CSPU is. A CSPU is not one of Oracle's usual quarterly releases. Oracle describes it as a set of targeted, high-priority security fixes in a smaller format that is easier to apply, complementing rather than replacing the quarterly cumulative Critical Patch Updates. The June 2026 CSPU included 106 Fusion Middleware patches, and several other Identity Manager CVEs were fixed alongside this one:

• CVE-2026-35267 (REST WebServices)
• CVE-2026-35268 (Core)
• CVE-2026-35269
• CVE-2026-35294
• CVE-2026-46792
• CVE-2026-46793 and CVE-2026-46794 (Connector)
• CVE-2026-46807 (OIM Legacy UI)
• CVE-2026-46810

In practice, the patch applied for CVE-2026-35265 also covers these related Identity Manager flaws.

How to get and confirm the fix.

• Patch numbers and steps: the advisory directs Fusion Middleware customers to the June 2026 Patch Availability Document, My Oracle Support document CPU195. This is a document identifier, not a patch number.
• Earlier patches: My Oracle Support Doc ID KA1182 lists current and previously released CSPU and CPU patches for Fusion Middleware products.
• Access: downloads require a valid Oracle support contract.
• Bundle and Stack Patch Bundle users: if you patch Identity Manager 12.2.1.4 through Oracle bundle patches or IDM Stack Patch Bundles, confirm that the bundle level you install includes the June 2026 CSPU content before treating the system as fixed.
• Scanner verification: Tenable Nessus plugin 324118, "Oracle Identity Manager (June 2026 CSPU)", flags 12.2.1.4.0 and 14.1.2.1.0 installs lacking the June 2026 CSPU patch and records the patch publication date as 6/16/2026. It relies only on the version the application reports about itself, so after patching also compare the applied patch inventory (for example, OPatch lsinventory output) against the patch IDs in the Patch Availability Document.

What about the October 2026 CPU? One upstream source claimed the October 2026 CPU offers a "more comprehensive" fix, but the October advisory does not support that. It does not mention CVE-2026-35265, although it ships new Identity Manager patches for the same release lines. Oracle says CPU patches are "usually cumulative", so moving to the October 2026 Identity Manager patch level would likely include the June fix. The June 2026 CSPU remains the official fix for this CVE. If you move straight to a later CPU, confirm in the Patch Availability Document that the June CSPU fix is included.

Interim measures. Oracle's advisory documents two general temporary approaches while patching is pending: blocking network protocols required by an attack, and removing unnecessary privileges or access. Oracle warns that both can break application functionality, do not correct the underlying flaw, and should be tested in nonproduction systems first. Oracle does not publish a CVE-specific filtering rule or privilege list for this issue.

Detection Methods

Current state. No exploit-specific signatures have been published for CVE-2026-35265. We found no public Sigma, Suricata, Snort, YARA or Nuclei rule. OffSeq's Threat Radar, which indexes the nuclei templates repository, Metasploit and the Exploit Database, lists this flaw as having no public nuclei template indexed and no public exploit code as of 4 November 2026. Without a public proof of concept there are no URI paths, parameters or payload patterns to match on. Detection therefore takes two forms: finding vulnerable hosts, and watching for what an attacker would do after exploitation.

1. Finding vulnerable installs

Tenable Nessus plugin 324118 (file oracle_identity_management_cpu_jun_2026.nasl) covers CVE-2026-35265 along with the other Identity Manager CVEs from the same patch. Before relying on it, note the following:

• It is a Local check (Nessus scanner or Nessus Agent on Windows, macOS and Unix) that requires the KB item installed_sw/Oracle Identity Manager. You need credentialed scans or agents. An unauthenticated network scan will not find it.
• It flags hosts running 12.2.1.4.0 or 14.1.2.1.0 without the June 2026 patch based solely on the self-reported version. Tenable notes the plugin does not actually test for the issues. Read a hit as "exposed", not "compromised", and check results by hand where patches were applied in unusual ways.
• Tenable recommends enabling thorough checks for this plugin.

To find instances scanners missed, search CMDB or SBOM data for the NVD CPE with the two affected versions:

cpe:2.3:a:oracle:identity_manager

2. Behavioral detection of post-exploitation activity

The attack consists of HTTP requests from a low-privileged account to functions that should need administrator rights, so the most reliable signal is privileged activity from accounts that should not be able to perform it. SentinelOne's vulnerability database lists the following indicators. Its page states the content is AI generated, so treat these as a hunting starting point rather than confirmed telemetry:

• Unexpected creation of new administrative or system accounts inside Identity Manager.
• Changes to role definitions, approval policies or access policies made by nonadministrative users.
• HTTP requests to Identity Manager privileged endpoints from accounts that have only ever used self-service paths.
• New or changed connectors and integration bindings to downstream target systems, since a compromised Identity Manager can push access to every connected system.

Turning this into detections

• Collect: enable verbose Identity Manager audit logging and forward it to your SIEM.
• Correlate: join WebLogic HTTP access logs with Identity Manager audit events by session or user, looking for requests that reach privileged paths from low-privileged sessions. The vulnerable endpoint is not public, so instead of matching a single URL, baseline which users normally call administrative functions and alert on callers outside that baseline.
• Watch for persistence and tampering: monitor changes to the OIM configuration and policy store, privileged role grants and orchestration events with unusual timing or initiators, plus configuration exports, new scheduler jobs and plugin uploads outside change windows.

CVE Brief gives similar advice: review audit logs for identity provisioning or changes that do not fit normal operations.

What to expect. As of NVD's last update the flaw is not in CISA KEV, and there are no confirmed in-the-wild IoCs (IPs, hashes, domains). Treat any IoC feed claiming to cover this CVE with suspicion. Keep watching the nuclei templates repository, SigmaHQ and vendor IDS updates, since a public exploit would likely be followed quickly by network signatures.

Affected Systems and Versions

• Product: Oracle Identity Manager (also documented as Oracle Identity Governance), Oracle Fusion Middleware
• Component: Security
• Affected supported versions: 12.2.1.4.0 and 14.1.2.1.0
• Exposure condition: an attacker with a low-privileged account and HTTP network access to the Identity Manager application
• Fixed in: June 2026 Critical Security Patch Update (separate patch per release line, listed in My Oracle Support document CPU195)

These are the versions Oracle explicitly documents as affected among supported releases. The records do not establish that every other release is unaffected.

Vendor Security History

Oracle runs quarterly cumulative Critical Patch Updates alongside smaller, targeted Critical Security Patch Updates for high-priority fixes, which is how this Identity Manager fix arrived in June between the regular quarterly releases. Oracle also states that it does not distribute exploit or proof-of-concept code for vulnerabilities in its products.

A useful point of comparison is the separate Oracle E Business Suite CVE-2025-61882. Google threat intelligence reporting describes activity that may have exploited that issue as early as 9 August 2025, before Oracle released a patch on 4 October 2025, with significant data exfiltration in some cases. That campaign used the CL0P extortion brand, but Google explicitly did not formally attribute it to a tracked group, noting that CL0P branding has not been used exclusively by FIN11.

That case illustrates the gap between having a patch program and preventing every exploitation campaign. It does not establish that CVE-2026-35265 is exploited, that the two flaws share a mechanism, or that the same actors are involved. For CVE-2026-35265, Feedly reports no evidence of exploitation or a public proof of concept, VulDB reports no public exploit, and no threat actor attribution exists.

References

• NVD entry for CVE-2026-35265
• CVE Record for CVE-2026-35265
• Oracle Critical Security Patch Update Advisory, June 2026
• Text Form of Oracle CSPU June 2026 Risk Matrices
• Oracle Critical Patch Update Advisory, October 2026
• My Oracle Support Patch Availability Document CPU195
• Oracle Security Blog: June 2026 Critical Security Patch Update Released
• Oracle Critical Patch Updates, Security Alerts and Bulletins
• Tenable Nessus Plugin 324118: Oracle Identity Manager (June 2026 CSPU)
• Tenable CVE page for CVE-2026-35265
• SentinelOne Vulnerability Database: CVE-2026-35265
• OffSeq Threat Radar: Oracle Fusion Middleware vulnerabilities
• CVE Brief: CVE-2026-35265
• VulDB entry 371468
• Feedly: CVE-2026-35265 Exploits and Severity
• MITRE CWE 306: Missing Authentication for Critical Function
• FIRST CVSS v3.1 Specification Document
• CISA Known Exploited Vulnerabilities Catalog
• CISA KEV JSON Feed
• Google Cloud: Oracle E Business Suite Zero Day Exploited in Widespread Extortion Campaign
• Oracle Identity and Access Management
• Oracle Identity Governance Suite Value
• Product Overview for Oracle Identity Governance 12.2.1.4
• Omdia Identity Governance and Administration 2022