CVE-2026-46794 is a critical vulnerability in the Oracle Fusion Middleware Identity Manager Connector (Generic Unix Connector component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. It allows a low privileged attacker with network access via SSH to compromise the Identity Manager Connector, resulting in a complete takeover. The vulnerability has a CVSS 3.1 score of 9.9 with network attack vector, low attack complexity, low privileges required, no user interaction, and scope change, causing high impact on confidentiality, integrity, and availability. Oracle has published this vulnerability in its June 2026 Critical Security Patch Update and advises immediate patching. The advisory also suggests possible temporary mitigations such as blocking network protocols or removing unnecessary privileges, though these may disrupt normal operations.

Successful exploitation of this vulnerability allows an attacker with low privileges and network access via SSH to take over the Identity Manager Connector component. This compromise can lead to significant impacts on confidentiality, integrity, and availability of the affected system. Additionally, the attack scope may extend beyond the Identity Manager Connector to other Oracle products integrated with it, increasing the potential damage.

Oracle has released security patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches as soon as possible to remediate the vulnerability. Until patches are applied, risk can be partially mitigated by blocking network protocols required for exploitation and by removing unnecessary privileges from users who do not require them. However, these mitigations may impact application functionality. Oracle recommends remaining on actively supported versions and promptly applying security patches.