This vulnerability affects Oracle Identity Manager Connector 12.2.1.4.0, part of Oracle Fusion Middleware. It is easily exploitable remotely over HTTPS without authentication, allowing attackers to gain unauthorized access to critical data and perform unauthorized data modifications. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) reflects network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality and integrity impact. Oracle's April 2026 Critical Patch Update addresses this and other vulnerabilities, recommending immediate patching for affected versions.

Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data accessible via Oracle Identity Manager Connector. This compromises confidentiality and integrity of sensitive data but does not affect availability. The vulnerability is remotely exploitable without authentication, increasing the risk of widespread impact if unpatched.

Oracle has released patches for this vulnerability as part of the April 2026 Critical Patch Update for Fusion Middleware products. Customers should apply these official patches without delay to remediate the vulnerability. Oracle strongly recommends staying on actively supported versions and promptly applying Critical Patch Updates. Patch status is confirmed as available via the vendor advisory: https://www.oracle.com/security-alerts/cpuapr2026.html.