Description
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Connector Framework). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Identity Manager. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
Published: 2026-10-20
Score: 4.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Partial Denial of Service
Action: Apply Patch
AI Analysis

Impact

This flaw resides in the Connector Framework of Oracle Identity Manager and permits a low-privileged user with network access over HTTP to trigger a partial denial of service. The vulnerability does not open avenues for data disclosure or privilege escalation; its sole consequence is an interruption or degradation of Availability for the affected service.

Affected Systems

Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 are affected; no other product variants are referenced in the CVE data.

Risk and Exploitability

The CVSS score of 4.3 places the issue in the low severity range, but the required conditions—a low privilege level and simple network access—make exploitation straightforward for an attacker. With the EPSS score of < 1% and the vulnerability not listed in CISA KEV, the likelihood of a widespread attack is modest. The primary risk is a temporary denial of service for a subset of users, potentially impacting business operations while other areas of the system remain intact.

Generated by OpenCVE AI on October 27, 2026 at 09:48 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply an Oracle patch or upgrade to a newer release that addresses the Connector Framework flaw if such a fix has been released.
  • Restrict HTTP access to the Oracle Identity Manager endpoints by limiting allowed IP addresses or network interfaces to trusted sources, reducing exposure to low-privilege attackers.
  • Enable detailed logging for HTTP requests that can trigger service disruptions and configure alerts for abnormal error rates or latency to detect potential denial-of-service attempts.

Generated by OpenCVE AI on October 27, 2026 at 09:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 29 Oct 2026 02:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 27 Oct 2026 10:15:00 +0000

Type Values Removed Values Added
Title Partial Denial of Service via HTTP in Oracle Identity Manager Connector Framework
Weaknesses CWE-400

Tue, 27 Oct 2026 06:45:00 +0000

Type Values Removed Values Added
Title Partial Denial of Service in Oracle Identity Manager Connector Framework

Tue, 27 Oct 2026 04:30:00 +0000

Type Values Removed Values Added
Title Partial Denial of Service in Oracle Identity Manager Connector Framework
Weaknesses CWE-284

Mon, 26 Oct 2026 20:00:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo

Thu, 22 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Oracle Corporation
Oracle Corporation oracle Identity Manager
Vendors & Products Oracle Corporation
Oracle Corporation oracle Identity Manager

Thu, 22 Oct 2026 10:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Connector Framework). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Identity Manager. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Identity Manager. CVSS 3.1 Base Score 4.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
First Time appeared Oracle
Oracle identity Manager
CPEs cpe:2.3:a:oracle:identity_manager:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:identity_manager:14.1.2.1.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle identity Manager
References
Metrics cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'}

Subscriptions

Oracle Identity Manager
Oracle Corporation Oracle Identity Manager
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-29T01:52:02.829Z

Reserved: 2026-09-28T15:40:09.487Z

Link: CVE-2026-101497

cve-icon Vulnrichment

Updated: 2026-10-29T01:48:31.553Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:17:58.870

Modified: 2026-10-29T02:16:44.020

Link: CVE-2026-101497

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T10:00:15Z

Weaknesses