The Oracle Identity Manager Connector is vulnerable to an easily exploitable flaw that allows an attacker with low privileges and network access via SSH to fully compromise the connector. Successful exploitation leads to loss of confidentiality, integrity, and availability of the component, effectively granting the attacker takeover of the Identity Manager Connector. The vulnerability can also impact additional Oracle Fusion Middleware products due to scope changes, exposing the broader environment to the same risks.

Oracle Corporation’s Identity Manager Connector, affected versions 12.2.1.4.0 and 14.1.2.1.0, are impacted by this flaw.

With a CVSS 3.1 Base Score of 9.9, the risk is high. The EPSS score is below 1%, indicating a low current exploitation probability, and the vulnerability is not yet listed in CISA’s KEV catalog. Nevertheless, the attack vector is network‑based via SSH and requires only low‑privilege access, making it quite attractive for adversaries. If exploited, the attacker gains full control of the connector and, through scope changes, potentially affects other components in the same environment.