This vulnerability affects Oracle Identity Manager Connector 12.2.1.4.0, part of Oracle Fusion Middleware. It allows an unauthenticated network attacker over HTTPS to compromise the connector, resulting in unauthorized access to critical or all accessible data. The CVSS vector indicates network attack vector, high attack complexity, no privileges required, no user interaction, and a high confidentiality impact. The vulnerability is associated with CWE-306 (Missing Authentication for Critical Function). Oracle has addressed this issue in its April 2026 Critical Patch Update, which includes multiple security patches for Fusion Middleware products.

Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by the Oracle Identity Manager Connector. There is no impact on integrity or availability reported. The vulnerability requires network access via HTTPS and is difficult to exploit. No known exploits in the wild have been reported at this time.

Oracle strongly recommends applying the April 2026 Critical Patch Update for Fusion Middleware products, which includes patches addressing this vulnerability. Customers should remain on actively supported versions and apply the Critical Patch Update without delay. Patch status is confirmed by the vendor advisory indicating that a fix is available in the April 2026 CPU. No alternative mitigations or 'no action required' statements are provided by Oracle.