CVE-2026-46793 is a critical security vulnerability in Oracle Fusion Middleware Identity Manager Connector (component: Database User) affecting versions 12.2.1.4.0 and 14.1.2.1.0. The flaw allows a low privileged attacker with network access via HTTP to compromise the Identity Manager Connector, resulting in potential full takeover. The vulnerability has a CVSS 3.1 score of 9.9 with high impact on confidentiality, integrity, and availability, and a scope change that may affect additional Oracle products. Oracle's June 2026 Critical Security Patch Update includes patches for this vulnerability among 245 others. The advisory emphasizes the importance of applying these patches promptly and suggests mitigating risk by blocking attack-related network protocols and restricting unnecessary privileges until patches are applied.

Successful exploitation of this vulnerability can lead to complete takeover of the Oracle Identity Manager Connector, compromising confidentiality, integrity, and availability of the affected system. Due to scope change, additional Oracle products integrated with or dependent on the Identity Manager Connector may also be impacted. The vulnerability is easily exploitable by a low privileged attacker with network access via HTTP, increasing the risk of widespread impact if unpatched.

Oracle strongly recommends applying the June 2026 Critical Security Patch Update promptly to remediate this vulnerability. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation and removing unnecessary privileges or access to relevant packages from users who do not need them. These mitigations may affect application functionality, so they should be tested carefully. Users should consult the Oracle advisory at https://www.oracle.com/security-alerts/cspujun2026.html for detailed patch availability and installation instructions.