This vulnerability affects Oracle Identity Manager Connector in Oracle Fusion Middleware (PeopleSoft Applications component) versions 12.2.1.4.0 and 14.1.2.1.0. It is difficult to exploit and requires a high privileged attacker with network access via HTTP. The vulnerability allows unauthorized creation, deletion, or modification of critical data accessible by the connector and may affect other Oracle products due to scope change. The CVSS 3.1 vector is AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N, reflecting network attack vector, high attack complexity, high privileges required, no user interaction, scope change, and high confidentiality and integrity impact.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle Identity Manager Connector. It may also lead to unauthorized access to critical data or complete access to all data accessible by the connector. The vulnerability affects confidentiality and integrity but does not impact availability. Additionally, due to scope change, other Oracle products integrated with or dependent on the connector may also be significantly impacted.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle strongly recommends applying security patches without delay and remaining on actively-supported versions. Since no explicit patch or workaround is stated in the advisory content provided, users should monitor Oracle's Critical Patch Update advisories for the availability of fixes and apply them promptly once released.