This vulnerability affects Oracle Identity Manager Connector, specifically versions 12.2.1.4.0 and 14.1.2.1.0. It requires a high privileged attacker with network access via LDAP to exploit. The vulnerability can lead to a full compromise of the Oracle Identity Manager Connector, with potential scope change affecting other Oracle products. The CVSS 3.1 vector is AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H, reflecting network attack vector, high attack complexity, high privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild. Oracle has included this fix in their August 2026 Critical Security Patch Update, which contains numerous patches across many products including Oracle Identity Manager Connector.

Successful exploitation allows a high privileged attacker with network access via LDAP to take over the Oracle Identity Manager Connector. This can lead to complete compromise of the component and may affect additional Oracle products due to scope change. The impact includes high confidentiality, integrity, and availability loss.

Oracle has released a Critical Security Patch Update in August 2026 that addresses this vulnerability among many others. Customers are strongly advised to apply the available security patches promptly. Oracle recommends remaining on actively-supported versions and applying security patches without delay to prevent exploitation. No specific temporary mitigations are indicated; patching is the primary remediation.