Description
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Identity Manager Connector. While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).
Published: 2026-09-15
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized modification and access to critical data
Action: Patch immediately
AI Analysis

Impact

A flaw in the Oracle Identity Manager Connector’s core component permits an unauthenticated attacker with network access via TCP to create, delete, or modify critical data accessible through the connector. This unauthorized activity compromises both confidentiality and integrity of that data, but does not provide remote code execution or denial of service. The weakness is identified as CWE-284, an Authorization problem.

Affected Systems

The vulnerability affects Oracle’s Identity Manager Connector, specifically versions 12.2.1.4.0 and 14.1.2.1.0, when those instances are reachable over the network. Systems with the connector exposed to external TCP traffic are susceptible to exploitation.

Risk and Exploitability

The CVSS v3.1 base score of 8.7 signals high severity, with significant confidentiality and integrity impact. The EPSS score below 1% indicates a very low likelihood of observed exploitation at present. The flaw is not listed in the CISA KEV catalog. Attackers need only unauthenticated network access to the connector’s TCP interface to leverage the vulnerability, which can also lead to unauthorized changes or deletion of critical data and may affect other Oracle products that rely on the connector.

Generated by OpenCVE AI on September 20, 2026 at 11:42 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the official Oracle patch for this vulnerability or upgrade to a non‑vulnerable version of the Identity Manager Connector.
  • Restrict inbound TCP traffic to the connector using firewall rules or network segmentation to limit exposure.
  • Implement monitoring and auditing of connector activity to detect unauthorized data access or modifications.

Generated by OpenCVE AI on September 20, 2026 at 11:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 12:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Exploit Allows Unauthorized Data Access in Oracle Identity Manager Connector

Thu, 17 Sep 2026 07:00:00 +0000

Type Values Removed Values Added
Title Unauthenticated Network Exploit Allows Unauthorized Data Access in Oracle Identity Manager Connector

Wed, 16 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Identity Manager Connector. While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N).
First Time appeared Oracle
Oracle identity Manager Connector
CPEs cpe:2.3:a:oracle:identity_manager_connector:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:identity_manager_connector:14.1.2.1.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle identity Manager Connector
References
Metrics cvssV3_1

{'score': 8.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N'}

Subscriptions

Oracle Identity Manager Connector
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-16T16:26:10.079Z

Reserved: 2026-08-31T15:40:57.332Z

Link: CVE-2026-83025

cve-icon Vulnrichment

Updated: 2026-09-16T15:43:15.379Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-15T20:18:10.473

Modified: 2026-09-22T19:09:36.763

Link: CVE-2026-83025

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T11:45:12Z

Weaknesses