The vulnerability lies in the Database User component of Oracle’s Identity Manager Connector. A low‑privileged attacker with network access through HTTP can exploit this flaw, gaining full control of the connector. The compromise leads to complete confidentiality, integrity and availability loss for the managed instance, effectively taking over the Identity Manager Connector.

Affected versions are Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0. The vulnerability may also allow attackers to impact other products that share the same connector component, due to a scope change. The description explicitly notes that attacks may propagate beyond the immediate product.

The CVSS 3.1 base score of 9.9 marks it as critical. The EPSS score is below 1 % yet the severity suggests high risk; however, the lack of a KEV listing means no public exploits have been identified yet. The attack vector is remote over HTTP, and any user with low privileges can initiate it. Exploitation requires no special credentials beyond access to the connector’s HTTP API.