This vulnerability affects Oracle Identity Manager Connector (Generic Unix Connector component) in versions 12.2.1.4.0 and 14.1.2.1.0. It requires an attacker to have physical access to the communication segment attached to the hardware where the connector runs, making it difficult to exploit. The vulnerability allows unauthorized modification of data and can cause repeated crashes, resulting in denial of service. The scope of impact extends beyond the connector to other Oracle products. The CVSS 3.1 base score is 8.0, reflecting high impact on integrity and availability with no confidentiality impact. Oracle has published a Critical Patch Update advisory but has not explicitly stated a patch or remediation level for this specific vulnerability.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data accessible by Oracle Identity Manager Connector, and can cause the connector to hang or crash repeatedly, leading to denial of service. The vulnerability affects data integrity and system availability but does not compromise confidentiality. The attack requires physical access to the communication segment, limiting remote exploitation. The vulnerability's impact scope includes additional Oracle products beyond the connector itself.

Patch status is not yet confirmed — check the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches promptly when available. Until a patch is confirmed, restrict physical access to the communication segments attached to the hardware running Oracle Identity Manager Connector to mitigate exploitation risk.