CVE-2026-35294 is an easily exploitable vulnerability in Oracle Fusion Middleware Identity Manager Connector (Mainframe Connectors component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. It allows a low privileged attacker with network access over HTTP to compromise the Identity Manager Connector, potentially leading to full takeover of the component. The vulnerability has a CVSS 3.1 score of 9.9 with network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impacts on confidentiality, integrity, and availability. Oracle has published this vulnerability in its June 2026 Critical Security Patch Update advisory, which includes patches for this and many other vulnerabilities. Oracle strongly recommends applying these patches without delay. Workarounds such as blocking network protocols or removing unnecessary privileges may reduce risk temporarily but could impact application functionality.

Successful exploitation of this vulnerability can result in complete takeover of the Oracle Identity Manager Connector component. Due to scope change, additional Oracle products integrated with or dependent on the Identity Manager Connector may also be significantly impacted. The vulnerability affects confidentiality, integrity, and availability, all at a high level, as reflected by the CVSS 3.1 base score of 9.9.

Oracle has released security patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk. Until patches are applied, risk reduction may be possible by blocking network protocols required for exploitation and by removing unnecessary privileges from users who do not need them. However, these mitigations may disrupt application functionality. Oracle recommends staying on actively supported versions and applying security patches without delay. Patch status is confirmed by the vendor advisory, which provides patch availability documentation.