Critical OCI Identity Domains Vulnerability: When Cloud Authorization Models Collide
Executive Summary
In March 2026, security researchers at NetSPI discovered a critical permission bypass vulnerability in Oracle Cloud Infrastructure (OCI) Identity Domains that allowed lower-privileged User Manager roles to escalate privileges and create API keys for Identity Domain Administrators. The vulnerability exploited a disconnect between two separate authorization models within OCI - traditional IAM policies and Identity Domain application roles - where different API endpoints failed to consistently enforce the same security boundaries. This allowed attackers with minimal User Manager permissions to gain full administrative control over identity domains, bypassing intended role separation controls. Oracle patched the vulnerability in June 2026 after a three-month disclosure process.
This incident highlights the growing complexity of cloud identity and access management systems, where multiple authorization models can create unexpected privilege escalation paths. As organizations increasingly adopt multi-cloud strategies and complex identity architectures, understanding the intersection of different permission systems becomes critical for preventing similar bypass vulnerabilities.
Why This Matters Now
This vulnerability demonstrates how modern cloud platforms' layered authorization models can create dangerous privilege escalation paths. With organizations rapidly adopting zero-trust architectures and complex identity systems, these authorization boundary failures represent a critical attack vector requiring immediate attention.
Attack Path Analysis
An attacker gained initial access to an OCI Identity Domain through compromised credentials or misconfiguration, exploited a permission bypass vulnerability to escalate from User Manager role to Identity Domain Administrator by creating API keys, moved laterally across identity domains and compartments using the elevated privileges, established command and control through the compromised API keys for persistent access, exfiltrated sensitive identity and access management data including user credentials and policies, and potentially caused impact through unauthorized access to cloud resources and data.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attacker gained access to OCI Identity Domain through compromised credentials, cloud misconfiguration, or authentication bypass affecting a user with User Manager role
MITRE ATT&CK® Techniques
Valid Accounts: Cloud Accounts
Valid Accounts: Cloud Accounts
Access Token Manipulation: SID-History Injection
Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access
Account Manipulation: Additional Cloud Credentials
Cloud Service Discovery
Cloud Infrastructure Discovery
Impair Defenses: Disable or Modify Cloud Firewall
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Authentication factors for privileged users
Control ID: 8.2.1
NYDFS 23 NYCRR 500 – Access Privileges
Control ID: 500.07
Digital Operational Resilience Act (DORA) – ICT Risk Management Framework
Control ID: Article 9
CISA Zero Trust Maturity Model 2.0 – Identity and Access Management
Control ID: ID.AM-2
NIS2 Directive – Cybersecurity risk management measures
Control ID: Article 21.2(a)
NIST SP 800-53 – Account Management
Control ID: AC-2
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
OCI identity domain permission bypass enables privilege escalation in cloud environments, compromising zero trust architectures and requiring immediate review of cloud access controls and segmentation policies.
Financial Services
Cloud misconfiguration vulnerability threatens HIPAA and PCI compliance requirements, enabling unauthorized access to sensitive financial data through compromised administrator accounts and API key manipulation.
Computer/Network Security
Identity domain administrator bypass exposes critical security infrastructure weakness, undermining multi-cloud visibility controls and threatening east-west traffic security in enterprise security fabric implementations.
Health Care / Life Sciences
Permission bypass vulnerability violates HIPAA data protection requirements, enabling unauthorized access to patient data through compromised cloud identity management and encrypted traffic interception capabilities.
Sources
- Administrating the Administrator, An OCI Identity Domains Permission Bypasshttps://www.netspi.com/blog/technical-blog/cloud-pentesting/administrating-the-administrator-an-oci-identity-domains-permission-bypass/Verified
- Oracle Cloud Infrastructure Documentation - Identity Domainshttps://docs.oracle.com/en-us/iaas/Content/Identity/home.htmVerified
- Oracle Security Alerts and Bulletinshttps://www.oracle.com/security-alerts/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would have significantly reduced the attacker's ability to exploit the OCI Identity Domain vulnerability by constraining lateral movement and limiting the blast radius of the privilege escalation across compartments and identity domains.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Zero Trust architecture would likely have constrained the initial compromise scope by implementing identity-aware access controls and continuous verification, reducing the attacker's ability to establish broad administrative access from the compromised User Manager account.
Control: Zero Trust Segmentation
Mitigation: Segmentation controls would likely have limited the privilege escalation by constraining access between identity management functions and administrative domains, reducing the attacker's ability to bypass authorization boundaries and create unauthorized API keys for higher privileged accounts.
Control: East-West Traffic Security
Mitigation: East-west traffic controls would likely have constrained lateral movement by enforcing segmentation between compartments and identity domains, limiting the attacker's ability to pivot across multiple OCI resources and reducing the scope of unauthorized access to different organizational boundaries.
Control: Multicloud Visibility & Control
Mitigation: Visibility and control mechanisms would likely have detected and constrained the unauthorized API key creation and SMTP credential establishment, reducing the attacker's ability to maintain persistent command and control channels through anomalous administrative activities.
Control: Egress Security & Policy Enforcement
Mitigation: Egress controls would likely have constrained data exfiltration by monitoring and restricting outbound data transfers from identity management systems and Object Storage, reducing the attacker's ability to extract large volumes of sensitive credentials and policy information.
While the attacker may have achieved some level of unauthorized access, the overall impact would likely have been significantly reduced through constrained blast radius, with damage limited to specific compartments rather than achieving broad administrative control across the entire OCI environment.
Impact at a Glance
Affected Business Functions
- Identity and Access Management
- Cloud Resource Administration
- API Key Management
- User Authentication Services
Estimated downtime: N/A
Estimated loss: N/A
Potential unauthorized access to administrator-level API keys within OCI Identity Domains, allowing privilege escalation from User Manager role to Identity Domain Administrator permissions. This could enable unauthorized access to cloud resources and services within the affected identity domain.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation with identity-based policies and least privilege access controls to prevent unauthorized privilege escalation between administrator roles
- • Deploy Multicloud Visibility & Control to monitor and detect anomalous interactions, suspicious automation, and repeated malformed requests across identity domains
- • Establish Egress Security & Policy Enforcement to prevent unauthorized API key creation and detect data exfiltration attempts from compromised administrative accounts
- • Enable Threat Detection & Anomaly Response with baseline monitoring to identify unusual administrative activities and API key generation patterns
- • Apply East-West Traffic Security controls to limit lateral movement between compartments and identity domains even with elevated privileges
