CVE-2026-71111: 
Oracle Identity Manager vulnerability analysis and mitigation

CVE-2026-71111 is a local privilege escalation vulnerability in the Installer component of Oracle Identity Manager, part of Oracle Fusion Middleware. It affects versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with local logon access to the infrastructure where Oracle Identity Manager executes can exploit this vulnerability to achieve a full takeover of the product. It carries a CVSS v3.1 base score of 7.8 (High) (Oracle Advisory, Feedly).

The vulnerability is classified under CWE-284 (Improper Access Control) and resides in the Installer component of Oracle Identity Manager. The attack vector is local, requiring only low privileges and no user interaction, with low attack complexity — making it straightforward to exploit once an attacker has a foothold on the host system. The flaw likely involves misconfigured file or directory permissions, insecure service configurations, or improper privilege separation during the installation process, enabling a local attacker to escalate privileges and compromise the entire Oracle Identity Manager instance. No public technical write-ups or proof-of-concept code have been identified at this time (Oracle Advisory, Feedly).

Successful exploitation results in a complete takeover of Oracle Identity Manager, with high impact to confidentiality, integrity, and availability. An attacker can read sensitive identity and access management data, modify system configurations and managed user accounts, and disrupt service availability. Given Oracle Identity Manager's role as a centralized identity governance platform, compromise could enable lateral movement across enterprise systems by manipulating provisioned accounts and access policies (Oracle Advisory, Feedly).

There is no evidence of active in-the-wild exploitation or publicly available proof-of-concept code at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.0015 (0.15%), indicating a low probability of exploitation in the near term. The NVD SSVC assessment notes the vulnerability is not automatable and has no known exploitation (Oracle Advisory, Feedly).

Oracle has addressed this vulnerability as part of the August 2026 Critical Security Patch Update (CSPU). Administrators should apply the relevant patches for Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 as soon as possible by following the guidance in the Fusion Middleware patch availability documentation. As interim mitigations, Oracle recommends restricting local logon access to systems running Oracle Identity Manager to authorized personnel only, implementing strong access controls, and monitoring local user activity on affected infrastructure. Oracle strongly advises against relying on workarounds as a long-term solution (Oracle Advisory).