CVE-2026-46810: 
Oracle Identity Manager vulnerability analysis and mitigation

CVE-2026-46810 is an improper access control vulnerability in the End User Self Service component of Oracle Identity Manager, part of Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.1.0. The vulnerability allows unauthenticated attackers with network access via the IIOP protocol to perform unauthorized read, insert, update, or delete operations on a subset of Identity Manager accessible data. It was disclosed on June 17, 2026, as part of Oracle's June 2026 Critical Security Patch Update, with a CVSS v3.1 base score of 6.5 (Medium) (Oracle Advisory, NVD).

The vulnerability is classified as CWE-284 (Improper Access Control), meaning the affected component fails to properly restrict access to Identity Manager data over the IIOP (Internet Inter-ORB Protocol) network interface (NVD). An unauthenticated remote attacker can exploit this flaw by sending crafted IIOP requests to the End User Self Service component without requiring any credentials or user interaction. The attack complexity is low and the vulnerability is considered automatable by CISA-ADP, meaning exploitation can be scripted or repeated at scale (Oracle Advisory). No public technical write-ups or proof-of-concept code have been identified at this time.

Successful exploitation allows an unauthenticated attacker to read a subset of Identity Manager accessible data (confidentiality impact) and perform unauthorized update, insert, or delete operations on some Identity Manager data (integrity impact). Availability is not impacted. Because Oracle Identity Manager is a centralized identity governance platform, unauthorized data manipulation could affect user provisioning, access rights, and role assignments across connected enterprise systems, potentially enabling privilege escalation or unauthorized access to downstream resources (Oracle Advisory, NVD).

Oracle has released patches for affected versions (12.2.1.4.0 and 14.1.2.1.0) as part of the June 2026 Critical Security Patch Update; customers should apply these patches immediately (Oracle Advisory). As a temporary workaround, organizations should restrict network access to the IIOP protocol interface (typically TCP port 3700) to trusted hosts only, using firewalls or network ACLs. Oracle strongly recommends against relying on network-level mitigations as a long-term solution, as they do not address the underlying vulnerability. Organizations should also monitor Identity Manager audit logs for unexpected data modification activities such as unauthorized inserts, updates, or deletes.