---
id: "CVE-2026-83403"
kind: "vulnerability"
aliases: ["CVE-2026-83403"]
title: "Oracle Identity Manager: low-privilege HTTP attacker can take over the server"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Oracle Identity Manager", "fixed": [], "affected": "12.2.1.4.0, 14.1.2.1.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["oracle-fusion-middleware", "oracle-identity-manager", "runtime", "self-hosted"]
not_affected_if: ["other-versions"]
published_at: "2026-10-20T22:19:56+00:00"
first_seen_at: "2026-10-23T21:57:25+00:00"
updated_at: "2026-10-24T00:03:01+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-83403", "first_seen_at": "2026-10-23T21:57:25+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:03:01+00:00"}]
---

# Oracle Identity Manager: low-privilege HTTP attacker can take over the server

Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 have a flaw in the OIM Legacy UI component. A low-privileged attacker with HTTP access can take over Identity Manager (CVSS 8.8). Oracle disclosed it in the October 2026 Critical Patch Update. No exploitation is reported and it is not in CISA KEV.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Oracle Identity Manager affected 12.2.1.4.0, 14.1.2.1.0 fixed ?

## How to check

Check whether you run Oracle Identity Manager 12.2.1.4.0 or 14.1.2.1.0 (for example with OPatch lsinventory in the OIM Oracle home), and whether the October 2026 CPU patch for Identity Manager is applied. Whether the OIM Legacy UI is deployed or reachable over HTTP is unknown. The Oracle advisory does not say if it can be disabled.

## Fix

Apply the October 2026 Oracle Critical Patch Update for Identity Manager (Fusion Middleware patch availability document on My Oracle Support). The exact patch number or build is unknown: it is behind the MOS document, which I did not read.

## Timeline

- 2026-10-23T21:57:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-83403
- 2026-10-24T00:03:01+00:00 analyst — Oracle October 2026 CPU (cpuoct2026) lists Identity Manager 12.2.1.4.0 and 14.1.2.1.0 as affected; the CVE record (via OpenCVE) says component OIM Legacy UI, CVSS 8.8 AV:N/PR:L. The CPU page gives no patch build (it is in the MOS patch availability doc, not read). Whether the legacy UI must be enabled is not stated anywhere I could read. No exploitation or PoC found, not in KEV. Public discussion not searched.

## Documents

- [advisory] Oracle Critical Patch Update Advisory - October 2026 https://www.oracle.com/security-alerts/cpuoct2026.html
- [describes] OpenCVE: CVE-2026-83403 (copy of Oracle CVE record) https://app.opencve.io/cve/CVE-2026-83403

## From the sources

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).  Supported versions that are affected are 12.2.1.4.0 and  14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager.  Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_