Description
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Identity Manager Connector. While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).
Published: 2026-09-15
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized modification and access to critical data
Action: Patch immediately
AI Analysis

Impact

A flaw in the Oracle Identity Manager Connector’s core component allows an unauthenticated attacker to create, full unauthorized access to all data accessible through the connector. The weaknessCWE‑284). No remote code execution or denial of service is disclosed, but confidentiality and integrity can be compromised for identity information.

Affected Systems

Oracle Identity affected. The vulnerable versions are 12.2.1.4.0 and 14.1.2.1.0, part of versions, if exposed to network traffic, are at risk.

Risk and Exploitability

The CVSS v3.1 base score of 8.7 demonstrates high severity with significant confidentiality and integrity impact. The EPSS score of less than 1% indicates a current very low likelihood of observed exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers only require network access and no authentication; the flaw can be leveraged over TCP to manipulate note means exploitation could affect other linked Oracle products.

Generated by OpenCVE AI on September 17, 2026 at 06:44 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Obtain and apply the official a fixed version.
  • Limit inbound TCP traffic to the connector service by configuring firewall rules or network segmentation so, removing default or weak accounts and requiring multi‑factor authentication where feasible.
  • Implement continuous monitoring of audit logs for unauthorized data modifications and anomalies.

Generated by OpenCVE AI on September 17, 2026 at 06:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 07:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Exploit Allows Unauthorized Data Access in Oracle Identity Manager Connector

Wed, 16 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Identity Manager Connector. While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).
First Time appeared Oracle
Oracle identity Manager Connector
CPEs cpe:2.3:a:oracle:identity_manager_connector:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:identity_manager_connector:14.1.2.1.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle identity Manager Connector
References
Metrics cvssV3_1

{'score': 8.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N'}

Subscriptions

Oracle Identity Manager Connector
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-16T16:26:10.079Z

Reserved: 2026-08-31T15:40:57.332Z

Link: CVE-2026-83025

cve-icon Vulnrichment

Updated: 2026-09-16T15:43:15.379Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T20:18:10.473

Modified: 2026-09-16T19:42:12.090

Link: CVE-2026-83025

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T06:45:03Z

Weaknesses