This vulnerability (CVE-2026-46794) affects Oracle Fusion Middleware Identity Manager Connector (Generic Unix Connector component) in versions 12.2.1.4.0 and 14.1.2.1.0. It allows a low privileged attacker with network access via SSH to compromise the Identity Manager Connector, resulting in a complete takeover. The vulnerability has a CVSS 3.1 base score of 9.9 with network attack vector, low attack complexity, low privileges required, no user interaction, and scope change, causing high impact on confidentiality, integrity, and availability. Oracle has addressed this vulnerability in its June 2026 Critical Security Patch Update, which contains targeted security fixes including for this product. Until patches are applied, risk can be reduced by blocking attack-related network protocols and removing unnecessary privileges, though these mitigations may impact functionality.

Successful exploitation allows an attacker with low privileges and network access via SSH to fully compromise the Identity Manager Connector, leading to complete takeover. This impacts confidentiality, integrity, and availability of the affected system. Due to scope change, additional Oracle products integrated with the Identity Manager Connector may also be significantly impacted.

Oracle has released security patches for this vulnerability as part of the June 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches without delay. Until patches are applied, risk may be mitigated by blocking network protocols required for exploitation and removing unnecessary privileges from users, though these measures may disrupt normal application functionality. Patch status is confirmed by Oracle's advisory at https://www.oracle.com/security-alerts/cspujun2026.html.