CVE-2026-46792 is a critical vulnerability in Oracle Fusion Middleware's Identity Manager Connector (Generic Unix Connector component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. The flaw allows a low privileged attacker with network access over HTTP to compromise the Identity Manager Connector, resulting in a potential full takeover of the component. The vulnerability has a CVSS 3.1 base score of 9.9, indicating high impact on confidentiality, integrity, and availability. The vulnerability also has scope change implications, potentially affecting additional Oracle products. Oracle has included fixes for this vulnerability in its June 2026 Critical Security Patch Update and strongly advises customers to apply these patches without delay. Until patches are applied, risk reduction may be achieved by blocking relevant network protocols and limiting user privileges related to the vulnerable component.

Successful exploitation allows an attacker with low privileges and network access via HTTP to fully compromise the Oracle Identity Manager Connector, leading to complete takeover. This results in high impact on confidentiality, integrity, and availability of the affected component and may extend to other Oracle products due to scope change. The vulnerability is rated critical with a CVSS score of 9.9.

Oracle has released security patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to remediate the vulnerability. Until patches are applied, risk can be mitigated by blocking network protocols required for exploitation (e.g., HTTP access to the component) and by removing unnecessary privileges or access to vulnerable packages from users who do not require them. Oracle recommends remaining on actively supported versions and applying security patches without delay.