CVE-2026-35269
Awaiting Analysis Awaiting Analysis - Queue

Unauthenticated Data Manipulation in Oracle Identity Manager

Publication date: 2026-06-17

Last updated on: 2026-06-17

Assigner: Oracle

Description
Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Identity Manager accessible data. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-06-17
Last Modified
2026-06-17
Generated
2026-07-08
AI Q&A
2026-06-17
EPSS Evaluated
2026-07-06
NVD
CVE-2026-35269
EUVD
EUVD-2026-37400

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
oracle identity_manager 12.2.1.4.0
oracle identity_manager 14.1.2.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Compliance Impact

This vulnerability allows an unauthenticated attacker to compromise Oracle Identity Manager, potentially leading to unauthorized creation, deletion, or modification of critical data. Such unauthorized access and data manipulation can negatively impact the integrity of sensitive information.

Compromise of data integrity and unauthorized access to critical data can lead to non-compliance with regulations like GDPR and HIPAA, which require strict controls over data access, integrity, and protection of personal and sensitive information.

Executive Summary

This vulnerability exists in the Identity Manager product of Oracle Fusion Middleware, specifically in the REST WebServices component. It affects supported versions 12.2.1.4.0 and 14.1.2.1.0.

The vulnerability is easily exploitable by an unauthenticated attacker who has network access via HTTP. Such an attacker can compromise the Identity Manager.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or any data accessible through Identity Manager.

Impact Analysis

This vulnerability can have a significant impact as it allows an unauthenticated attacker to compromise the Identity Manager remotely.

The attacker could create, delete, or modify critical data or any data accessible via Identity Manager without authorization.

This can lead to integrity issues within your system, potentially disrupting operations or causing data corruption.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-35269. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart