Description
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Identity Manager Connector executes to compromise Oracle Identity Manager Connector. While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).
Published: 2026-09-15
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized access and potential modification of sensitive data within Oracle Identity Manager Connector
Action: Immediate patch
AI Analysis

Impact

The vulnerability affects the Oracle Identity Manager Connector component, allowing an attacker who can physically connect to the hardware to create, delete, or modify access permissions for critical data. This bypasses normal authorization controls, leading to confidentiality and integrity compromises. Both affected processors can also be impacted due to the scope change, potentially giving attackers broader system access.

Affected Systems

Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 are vulnerable. Users running these releases should immediately verify and correct the installation.

Risk and Exploitability

The CVSS v3.1 score of 9.3 highlights the severe impact of the flaw. Although the EPSS score is less than 1%, indicating a low probability of widespread exploitation based on current data, the lack of a KEV listing does not reduce the need for urgent remediation. The attack requires physical access to the hardware, meaning it is an AV:A vector with local execution, no privilege or user interaction needed. Once accessed, the attacker can gain high-impact confidentiality and integrity effects on the system and related products.

Generated by OpenCVE AI on September 17, 2026 at 04:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Download and apply Oracle’s latest patch or upgrade Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 to the latest stable release.
  • Restrict physical access to the server running the Connector, ensuring only authorized personnel can attach to its communication segment.
  • Implement network segmentation or firewall rules to isolate the Connector from internal networks, preventing unauthorized connections to its service interfaces.

Generated by OpenCVE AI on September 17, 2026 at 04:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 17 Sep 2026 04:45:00 +0000

Type Values Removed Values Added
Title Unauthorized Access and Data Modification via Physical Segment in Oracle Identity Manager Connector

Wed, 16 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 20:15:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Identity Manager Connector executes to compromise Oracle Identity Manager Connector. While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 9.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N).
First Time appeared Oracle
Oracle identity Manager Connector
CPEs cpe:2.3:a:oracle:identity_manager_connector:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:identity_manager_connector:14.1.2.1.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle identity Manager Connector
References
Metrics cvssV3_1

{'score': 9.3, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N'}

Subscriptions

Oracle Identity Manager Connector
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-09-16T16:25:57.984Z

Reserved: 2026-08-31T15:40:57.332Z

Link: CVE-2026-83027

cve-icon Vulnrichment

Updated: 2026-09-16T15:43:20.494Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-15T20:18:10.757

Modified: 2026-09-16T19:42:12.090

Link: CVE-2026-83027

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-17T04:30:08Z

Weaknesses