This vulnerability in Oracle Fusion Middleware Identity Manager Connector (versions 12.2.1.4.0 and 14.1.2.1.0) allows an attacker with low privileges and network access via HTTP to compromise the component. The vulnerability has a critical CVSS 3.1 score of 9.9, indicating high impact on confidentiality, integrity, and availability. Exploitation can lead to takeover of the Identity Manager Connector and potentially impact other Oracle products. Oracle's June 2026 Critical Security Patch Update includes fixes for this vulnerability. Oracle advises immediate patching and provides guidance on temporary mitigations such as blocking network protocols and restricting privileges to reduce attack risk until patches are applied.

Successful exploitation results in complete compromise of the Identity Manager Connector, affecting confidentiality, integrity, and availability of the system. The vulnerability's scope change means that additional Oracle products integrated with or dependent on the Identity Manager Connector may also be impacted. This can lead to unauthorized access, data breaches, and disruption of services.

Oracle has released security patches as part of the June 2026 Critical Security Patch Update that address this vulnerability. Customers are strongly advised to apply these patches without delay. Until patches are applied, risk can be mitigated by blocking network protocols required for exploitation and by removing unnecessary privileges or access to certain packages from users who do not need them. Oracle warns that these mitigations may disrupt application functionality. Patch status is confirmed by the vendor advisory; therefore, applying the official patches is the recommended remediation.