This vulnerability affects Oracle Identity Manager Connector in Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.1.0. It is an easily exploitable vulnerability that allows unauthenticated attackers with network access via HTTP to compromise the product. Successful exploitation can lead to unauthorized access to critical data or complete access to all data accessible by the Oracle Identity Manager Connector. The vulnerability has a CVSS 3.1 base score of 8.6 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N, indicating network attack vector, low attack complexity, no privileges or user interaction required, scope change, and high confidentiality impact without integrity or availability impact. The vendor advisory points to Oracle's Critical Patch Update July 2026, which includes numerous patches across Oracle products, but does not explicitly confirm a patch for this vulnerability in the provided content. Customers are advised to review the advisory and apply patches promptly.

An unauthenticated attacker with network access via HTTP can exploit this vulnerability to gain unauthorized access to critical data within Oracle Identity Manager Connector. The confidentiality of sensitive information is at high risk, potentially leading to data compromise. There is no impact on integrity or availability reported. The vulnerability's scope change means that exploitation may affect additional Oracle products beyond the connector itself.

Patch status is not yet confirmed — check the vendor advisory at https://www.oracle.com/security-alerts/cpujul2026.html for current remediation guidance. Oracle recommends applying security patches without delay and staying on actively supported versions. Until a patch is confirmed and applied, restrict network access to Oracle Identity Manager Connector instances to trusted users only and monitor for unusual access patterns. No vendor advisory states 'no action required' or 'already mitigated.'