This vulnerability affects Oracle Identity Manager Connector, part of Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.1.0. It is easily exploitable by an attacker with high privileges and network access via HTTPS. Exploitation can result in unauthorized creation, deletion, or modification of critical data within the Oracle Identity Manager Connector and potentially affect other Oracle products due to scope change. The CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N, reflecting network attack vector, low attack complexity, high privileges required, no user interaction, scope change, and high confidentiality and integrity impacts without availability impact. Oracle has published a Critical Security Patch Update (CSPU) in August 2026 addressing this and many other vulnerabilities. Customers are strongly advised to apply the patches promptly.

The vulnerability allows unauthorized modification and access to critical data within Oracle Identity Manager Connector, which can extend to other Oracle products due to scope change. This can compromise confidentiality and integrity of sensitive data, potentially leading to significant operational and security risks for affected organizations.

Oracle has released security patches for this vulnerability as part of the August 2026 Critical Security Patch Update. Customers should apply the relevant patches without delay to remediate the vulnerability. Oracle strongly recommends remaining on actively-supported versions and promptly applying security patches. No alternative mitigations or workarounds are specified in the vendor advisory.