{"id":"CVE-2026-83403","kind":"vulnerability","aliases":["CVE-2026-83403"],"related":[],"title":"Oracle Identity Manager: low-privilege HTTP attacker can take over the server","description":"Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).","summary":"Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 have a flaw in the OIM Legacy UI component. A low-privileged attacker with HTTP access can take over Identity Manager (CVSS 8.8). Oracle disclosed it in the October 2026 Critical Patch Update. No exploitation is reported and it is not in CISA KEV.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Oracle Identity Manager","fixed":[],"affected":"12.2.1.4.0, 14.1.2.1.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["oracle-fusion-middleware","oracle-identity-manager","runtime","self-hosted"],"not_affected_if":["other-versions"],"how_to_check":"Check whether you run Oracle Identity Manager 12.2.1.4.0 or 14.1.2.1.0 (for example with OPatch lsinventory in the OIM Oracle home), and whether the October 2026 CPU patch for Identity Manager is applied. Whether the OIM Legacy UI is deployed or reachable over HTTP is unknown. The Oracle advisory does not say if it can be disabled.","fix":"Apply the October 2026 Oracle Critical Patch Update for Identity Manager (Fusion Middleware patch availability document on My Oracle Support). The exact patch number or build is unknown: it is behind the MOS document, which I did not read.","status":"open","published_at":"2026-10-20T22:19:56+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","triaged_at":"2026-10-23T22:34:42+00:00","updated_at":"2026-10-24T00:03:01+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-23T22:34:42Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Oracle Critical Patch Update for Identity Manager 12.2.1.4.0 and 14.1.2.1.0; the sources do not name the patched build.","reach":"network","title":"Oracle Identity Manager: low-privilege HTTP attacker can take over the server","impact":"high","summary":"Oracle Identity Manager's OIM Legacy UI component has a flaw that lets a low-privileged user reach the server over HTTP. A successful attack gives the attacker full takeover of confidentiality, integrity and availability, per CVSS 8.8.","category":"runtime","who_cares":["oracle-identity-manager","oracle-fusion-middleware"],"confidence":0.6,"needs_auth":"yes","worst_case":"attacker takes over the Identity Manager server with low-privilege account","analyst_note":"Find the Oracle CPU advisory for the patched build and confirm whether the OIM Legacy UI must be enabled to be exposed.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["other-versions"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000513,"input_tokens":3090,"output_tokens":407,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Oracle CPU advisory for the patched build and confirm whether the OIM Legacy UI must be enabled to be exposed.","search":"'-2026':15A,18A '-83403':16A,19A '/av':154C '12.2.1.4.0':38B,107C '14.1.2.1.0':40B,109C '2026':71B '3.1':141C,153C '8.8':64B,144C 'access':57B,119C 'affect':105C 'allow':113C 'attack':8A,54B,116C,128C 'avail':148C 'base':142C 'cisa':84B 'compon':49B,97C 'compromis':123C 'confidenti':145C 'critic':72B 'cve':14A,17A 'cvss':63B,140C,150C,152C 'disclos':66B 'easili':110C 'exploit':76B,111C 'flaw':43B 'fusion':25B,95C 'h':162C 'h/a':161C 'h/i':160C 'host':34B 'http':7A,56B,121C 'ident':2A,29B,36B,61B,90C,125C,138C 'identity':21A 'impact':149C 'integr':146C 'kev':85B 'l/pr':156C 'l/ui':157C 'legaci':47B,99C 'low':5A,52B,114C 'low-privileg':4A,51B 'manag':3A,30B,37B,62B,91C,126C,139C 'manager':22A 'middlewar':26B,96C 'n/ac':155C 'n/s':158C 'network':118C 'octob':70B 'oim':46B,98C 'oracl':1A,24B,28B,35B,65B,89C,94C,124C,137C 'oracle':20A 'oracle-fusion-middlewar':23B 'oracle-identity-manag':27B 'patch':73B 'privileg':6A,53B,115C 'product':92C 'report':78B 'result':133C 'runtim':31B 'score':143C 'self':33B 'self-host':32B 'server':13A 'success':127C 'support':101C 'take':10A,59B 'takeov':135C 'u/c':159C 'ui':48B,100C 'updat':74B 'vector':151C 'version':102C 'via':120C 'vulner':86C,112C,131C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T22:19:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secalert_us@oracle.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-83403","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83403","severity":null,"published_at":"2026-10-20T22:19:56+00:00","modified_at":"2026-10-21T18:44:19+00:00","first_seen_at":"2026-10-23T21:57:25+00:00","fetched_at":"2026-10-23T22:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-83403:574","url":null,"severity":null,"published_at":"2026-10-24T00:03:01+00:00","modified_at":"2026-10-24T00:03:01+00:00","first_seen_at":"2026-10-24T00:03:01+00:00","fetched_at":"2026-10-24T00:03:01+00:00","note":"Oracle October 2026 CPU (cpuoct2026) lists Identity Manager 12.2.1.4.0 and 14.1.2.1.0 as affected; the CVE record (via OpenCVE) says component OIM Legacy UI, CVSS 8.8 AV:N/PR:L. The CPU page gives no patch build (it is in the MOS patch availability doc, not read). Whether the legacy UI must be enabled is not stated anywhere I could read. No exploitation or PoC found, not in KEV. Public discussion not searched."}],"documents":[{"id":1637,"url":"https://www.oracle.com/security-alerts/cpuoct2026.html","title":"Oracle Critical Patch Update Advisory - October 2026","kind":"advisory","source":"analyst","text":"Lists Oracle E-Business Suite, versions 12.2.3-12.2.15 as affected; patches via Patch Availability Document (MOS). Released 2026-10-20.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2325,"url":"https://app.opencve.io/cve/CVE-2026-83403","title":"OpenCVE: CVE-2026-83403 (copy of Oracle CVE record)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}