This vulnerability affects Oracle Identity Manager Connector, a component of Oracle Fusion Middleware. It is exploitable by an attacker with low privileges who has logon access to the infrastructure hosting the connector. Successful exploitation can result in complete compromise of the Oracle Identity Manager Connector, affecting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates the attack requires local access (AV:L), low complexity (AC:L), low privileges (PR:L), no user interaction (UI:N), and results in high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). Oracle has addressed this vulnerability in its September 2026 Critical Security Patch Update, which includes targeted security fixes for affected products and versions.

The vulnerability allows an attacker with low privileges and logon access to the infrastructure to fully compromise the Oracle Identity Manager Connector. This can lead to unauthorized disclosure, modification, or destruction of data and disruption of service, severely impacting confidentiality, integrity, and availability of the affected component.

Oracle has released patches addressing this vulnerability in the September 2026 Critical Security Patch Update. Customers are strongly advised to apply these security patches promptly to mitigate the risk. Oracle recommends remaining on actively supported versions and applying security updates without delay. No alternative mitigations or workarounds are specified in the advisory.