This vulnerability affects Oracle Identity Manager Connector in Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.1.0. It requires a low privileged attacker to have logon access to the infrastructure and involves user interaction from a third party. The vulnerability has a CVSS 3.1 base score of 7.2, indicating high severity, with confidentiality and integrity impacts and a scope change. Successful exploitation can result in unauthorized access and modification of critical data within the Oracle Identity Manager Connector and potentially other products. The attack complexity is high, and user interaction is required.

The vulnerability can lead to unauthorized creation, deletion, or modification of critical data accessible by Oracle Identity Manager Connector. It also allows unauthorized access to critical data or complete access to all data accessible by the connector. The scope of impact may extend beyond the connector to additional products. The attack requires low privileges but also human interaction from a user other than the attacker, making exploitation difficult.

Oracle has released a Critical Security Patch Update (CSPU) in August 2026 that addresses this vulnerability among others. Customers are strongly advised to apply the available security patches promptly and remain on actively supported versions. No indication from the vendor advisory suggests that no action is required or that the vulnerability is already mitigated without patching. Therefore, applying the official Oracle patches is the recommended mitigation.