This vulnerability affects Oracle Identity Manager Connector in Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.1.0. It is exploitable remotely by unauthenticated attackers with network access via TCP, though it is considered difficult to exploit. The vulnerability allows attackers to gain unauthorized creation, deletion, or modification access to critical data or all data accessible by the Oracle Identity Manager Connector. The scope of impact extends beyond the connector itself, potentially affecting other Oracle products. The CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N, reflecting network attack vector, high attack complexity, no privileges or user interaction required, scope change, and high confidentiality and integrity impacts.

Successful exploitation can result in unauthorized creation, deletion, or modification of critical data within Oracle Identity Manager Connector and possibly other Oracle products due to scope change. This compromises confidentiality and integrity of sensitive data but does not affect availability. The vulnerability allows an unauthenticated attacker to gain significant control over data accessible by the connector, posing a serious risk to affected environments.

Oracle has released security patches addressing this vulnerability as part of the September 2026 Critical Security Patch Update. Customers are strongly advised to apply the relevant patches promptly to affected versions 12.2.1.4.0 and 14.1.2.1.0 of Oracle Identity Manager Connector. Oracle recommends remaining on actively-supported versions and applying security patches without delay to mitigate exploitation risks. Patch status is confirmed by the vendor advisory. No alternative mitigations or workarounds are specified.