This vulnerability affects Oracle Identity Manager Connector, part of Oracle Fusion Middleware. It is exploitable remotely without authentication over HTTP and can lead to unauthorized access to sensitive data within the product. The vulnerability also has a scope change impact, meaning it may affect additional Oracle products beyond the connector itself. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, scope change, and high confidentiality impact without integrity or availability impact. Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update.

Successful exploitation can result in unauthorized access to critical or all data accessible by Oracle Identity Manager Connector. The vulnerability's scope change means it may also impact other Oracle products connected to or dependent on the connector, potentially broadening the impact. The confidentiality impact is high, but there is no direct impact on integrity or availability.

Oracle has released patches for this vulnerability as part of the September 2026 Critical Security Patch Update. Users of affected versions 12.2.1.4.0 and 14.1.2.1.0 should apply the relevant patches promptly to mitigate the risk. Oracle strongly recommends remaining on actively supported versions and applying security patches without delay. No alternative mitigations or workarounds are specified in the advisory.