A vulnerability in the Oracle Identity Manager Connector allows an unauthenticated attacker who can reach the connector over HTTP to gain complete access to all data exposed by the Connector. The flaw is easily exploitable and can result in unauthorized disclosure of confidential data, potentially affecting any component that relies on the Connector’s REST endpoints. The weakness resides in inadequate access control checks that permit usage of privileged operations without proper authentication.

Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 are affected. The product is part of Oracle Fusion Middleware and the generic REST component is used by admins and integrations to access identity data across the enterprise. Although the vulnerability is only in the Connector, the impact may extend to other Oracle Fusion Middleware services, as the attack may alter the security scope of associated applications.

The CVSS 3.1 base score of 8.6 indicates high severity for confidentiality impact. The EPSS score of 0.303% indicates a low but non-zero probability of exploitation. The lack of a KEV listing does not reduce the risk; the attacker only requires network access to the exposed HTTP interface. The attack vector is inferred to be over the public internet or internal network if the Connector is reachable. Given the public nature of the service, exploitation remains significant until a patch is applied.