This vulnerability affects Oracle Identity Manager Connector in Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.1.0. It is easily exploitable by a low privileged attacker who has logon access to the infrastructure hosting the connector. Successful exploitation can result in complete compromise of the Oracle Identity Manager Connector. The CVSS 3.1 vector indicates low attack vector (local), low attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Oracle's August 2026 Critical Security Patch Update advisory references this vulnerability among many others but does not provide explicit patch details for it in the provided text.

The vulnerability allows an attacker with low privileges and local access to the infrastructure to fully compromise the Oracle Identity Manager Connector, impacting confidentiality, integrity, and availability of the affected component. This could lead to takeover of the connector, potentially affecting identity management operations within the environment.

Oracle strongly recommends applying security patches promptly as part of their Critical Security Patch Update process. Although the vendor advisory does not explicitly confirm a patch for this specific vulnerability in the provided content, it is included in the August 2026 Critical Security Patch Update advisory. Organizations should review the official Oracle advisory at https://www.oracle.com/security-alerts/cspuaug2026.html for patch availability and installation instructions. Maintaining actively supported versions and applying all relevant security patches without delay is advised.