Description
Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Connectors and Connector Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via SOAP to compromise Oracle Identity Manager Connector. While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N).
Published: 2026-10-20
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: High privilege escalation and unauthorized data modification
Action: Immediate Patch
AI Analysis

Impact

A flaw in the Oracle Identity Manager Connector’s SOAP interface permits a high-privilege attacker with network connectivity to create, delete, or modify the data managed by the connector. This flaw is an access control and privilege management weakness (CWE-284 and CWE-269). The vulnerability is exploitable remotely and can result in loss of confidentiality and integrity of critical information exposed through the connector. The affected releases are 12.2.1.4.0 and 14.1.2.1.0, both components of Oracle Fusion Middleware.

Affected Systems

Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 are the only affected releases. These connectors are used to manage identity and access policies within Oracle Fusion Middleware.

Risk and Exploitability

The flaw can be reached over the network via SOAP calls, requires high privileges, and no user interaction. The CVSS v3.1 base score of 8.7 indicates significant confidentiality and integrity impacts. EPSS is less than 1%, and the vulnerability is not listed in CISA KEV. Because it can change scope, a successful exploit could also affect other products integrated with the connector.

Generated by OpenCVE AI on October 28, 2026 at 01:33 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Oracle patch for Oracle Identity Manager Connector 12.2.1.4.0 and 14.1.2.1.0 as published in the Oracle CPU Oct 2026 advisory
  • Restrict network access to the Connector’s SOAP endpoints to trusted hosts or VPNs, ensuring only authorized system components can reach them
  • Harden the Connector configuration by removing or minimizing high-privilege roles that expose the vulnerable APIs and enforce the principle of least privilege for all service accounts
  • Monitor audit logs for abnormal SOAP activity or data changes following patching

Generated by OpenCVE AI on October 28, 2026 at 01:33 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 28 Oct 2026 02:00:00 +0000

Type Values Removed Values Added
Title High Privilege SOAP Access Control Vulnerability in Oracle Identity Manager Connector
Weaknesses CWE-269
CWE-284

Tue, 27 Oct 2026 22:45:00 +0000

Type Values Removed Values Added
Title High‑Privilege Data Modification Vulnerability via SOAP in Oracle Identity Manager Connector
Weaknesses CWE-284
CWE-862

Tue, 27 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo

Wed, 21 Oct 2026 18:00:00 +0000

Type Values Removed Values Added
Title High‑Privilege Data Modification Vulnerability via SOAP in Oracle Identity Manager Connector
Weaknesses CWE-284
CWE-862

Tue, 20 Oct 2026 21:30:00 +0000

Type Values Removed Values Added
Description Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Connectors and Connector Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via SOAP to compromise Oracle Identity Manager Connector. While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized access to critical data or complete access to all Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N).
First Time appeared Oracle
Oracle identity Manager Connector
CPEs cpe:2.3:a:oracle:identity_manager_connector:12.2.1.4.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:identity_manager_connector:14.1.2.1.0:*:*:*:*:*:*:*
Vendors & Products Oracle
Oracle identity Manager Connector
References
Metrics cvssV3_1

{'score': 8.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N'}

Subscriptions

Oracle Identity Manager Connector
cve-icon MITRE

Status: PUBLISHED

Assigner: oracle

Published:

Updated: 2026-10-28T17:01:14.462Z

Reserved: 2026-09-14T22:10:16.614Z

Link: CVE-2026-91211

cve-icon Vulnrichment

Updated: 2026-10-28T17:01:09.774Z

cve-icon NVD

Status : Modified

Published: 2026-10-20T22:20:21.430

Modified: 2026-10-28T17:18:50.227

Link: CVE-2026-91211

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T01:45:12Z

Weaknesses